NATIONAL SECURITY AGENCY 

FORT GEORGE G. MEADE, MARYLAND 20755-6000 



FOIA Case: 104627A 
9 November 2019 


MUCKROCK 
DEPTMR 56530 
411A HIGHLAND AVE. 

SUMMERVILLE, MA 02144-2516 

Dear Emma Best: 

This responds to your Freedom of Information Act (FOIA) request of 
20 June 2018, for “Copies of initial emails (not including replies) sent to 
tech_transfer@nsa.gov from 2010 to the present.” Your request was received 
on 21 June 2018, and has been assigned Case Number 104627. There are no 
assessable fees for this request; therefore, we did not address your fee category 
or your request for a fee waiver. 

Your request has been processed under the FOIA and some of the 
documents you requested are enclosed. Certain information, however, has 
been deleted from the enclosures and some documents containing commercial 
and financial information that is privileged or otherwise confidential have been 
withheld in their entirety pursuant to the fourth exemption of the FOIA. 

During the course of our search it was discovered that the Technology 
Transfer Program (TTP) established their mail feature in 2012. Thus only 
records from 2012 through 2018 are enclosed. However, certain information 
has been deleted from the enclosures. 

Information which would reveal NSA/CSS functions and activities and 
names of NSA/CSS employees have been deleted from the enclosures. These 
deletions are exempt from disclosure pursuant to the third exemption of the 
FOIA which provides for the withholding of information specifically protected 
from disclosure by statute. The specific statute applicable in this case is 
Section 6, Public Law 86-36 (50 U.S. Code 3605). 

In addition, commercial and financial information that is privileged or 
otherwise confidential has been deleted from the enclosures, pursuant to the 
fourth exemption of the FOIA. 



FOIACase: 104627A 


In addition, some of the information has been deleted from the 
enclosures pursuant to ihe fifth exemption of the FOIA. This exemption 
applies to inter-agency or intra-agency memoranda or letters which would not 
be available by law to a party in litigation with the agency, protecting 
information that is normally privileged in the civil discovery context, such as 
information that is part of a pre-decisional deliberative process. 

Finally, personal information regarding an individual has been deleted 
from the enclosures in accordance with 5 U.S.C. 552 (b)(6). This exemption 
protects from disclosure information that would constitute a clearly 
unwarranted invasion of personal privacy. In balancing the public interest for 
the information you request against the privacy interests involved, we have 
determined that the privacy interests sufficiently satisfy the requirements for 
the application of the (b)(6) exemption. 

Since some documents were withheld in their entirety and information 
was withheld from the enclosures, you may construe this as a partial denial of 
your request. You are hereby advised of this Agency’s appeal procedures. 

You may appeal this decision. If you decide to appeal, you should do so 
in the manner outlined below. NSA will endeavor to respond within 20 working 
days of receiving any appeal, absent any unusual circumstances. 

• The appeal must be sent via U.S. postal mail, fax, or electronic 
delivery (e-mail) and addressed to: 

NSA FOIA/PA Appeal Authority (P132) 

National Security Agency 

9800 Savage Road STE 6932 

Fort George G. Meade, MD 20755-6932 

The facsimile number is 443-479-3612. 

The appropriate email address to submit an appeal is 

FOIARSCte nsa.gov. 

• It must be postmarked or delivered electronically no later than 90 
calendar days from the date of this letter. Decisions appealed after 
90 days will not be addressed. 

• Please include the case number provided above. 

• Please describe with sufficient detail why you believe the denial of 
requested information was unwarranted. 

You may also contact our FOIA Public Liaison at foialo@nsa.gov for any 
further assistance and to discuss any aspect of your request. Additionally, you 
may contact the Office of Government Information Services (OGIS) at the 
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National Archives and Records Administration to inquire about the FOIA 
mediation services they offer. The contact information for OGIS is as follows: 

Office of Government Information Services 

National Archives and Records Administration 

8601 Adclphi Rd. - OGIS 

College Park, MD 20740 

ogis@nara.gov 

877-684-6448 

(Fax) 202-741-5769 

Sincerely, 

'V. -- 

JOHN R. CHAPMAN 
Chief, FOIA/PA Office 
NSA Initial Denial Authority 


Ends: 

a/s 



Doc ID: 6687022 


From; 

To; 

Subject; 

Date; 


(b)(3)-P.L. B6-3c 


(U) 2-Day Exchange 2010 Mailbox MigratiSn Will Begin at 1600 hours (4:00 

p.m.) on Sunday (August 5, 2012) ^ • 

Thursday, August 02, 2012 8:52:05 AM ^ • 


(UZ/ fOUQ) This IS a remint:;- that | [ will be migrating your unclassified 

mailbox to an Exchange 2010 server. There will be no changes made to your Outlook mailbox 
(or to your desktop). The migration will take approximately 4-5 hours. After that time, you 
may reopen your Outlook m lOg back in at the start of your next work day. 


(U) What do I need to do foi the migration? 


(U //rOUO) IF you cannot Ire migrated on the above date due to mission reasons, please email 
^-pe l | n order to resc hedule. If you have a ny 

issues after the migration oi need more information, pfease email thej _ ^ at 

I IYou may also contact the Information Technology Support Center (ITSC)-by 


ca 


lling[ 


I;--... 


Thank you. 


(b) (3)-P.L. 86-36 
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(b) ( 6 ) 


From: 

To: 

Subject: Action, Response Requested; Patent Searching via Visualization^ , • 

Date: Monday, November 26, 2012 12:27:37 PM ^ ' 

Importance: High ^ * 

^ • 

.. ' ^ 

To Whom It May Concern: . . • ’ 





My name is 

Department of Energy's Pacific IT 


a Commercialization Manager in the Technology Transfer department at the 
hwest National Laboratory in Richland, Washington. 


I am writing to request a quick co .vith the Technology Transfer representative who is responsible for the marketing 
and communications of availab ■. rechnologies in your department. The Lab recently completed a project which 
categorizes and visualizes all of -‘.e DOE's active patent and patent applications. The goal being, make available 
technologies more accessible t.; .rnnology seekers. The Visual Patent Search tool is available for viewing at: 


During the call I would like to ki whether the framework would help you organize your patents for technology 
seekers looking to license innov ons. 


Please suggest 2-3 meeting tim---, 


me a call at 



.'ver the next two weeks that may work for your schedule. Also, feel free to give 
ledule. 


Thanks, 

□ 




Commercialization Manager 
Technology Commercialization 

Pacific Northwest National Laboratory 
902 Battelle Boulevard 
P.O. Box 999, MSIN Kl-71 , . • ‘ * 
Richland. WA 99352 USA 



PNNL's Available Technologies r osite provides searchable access to our ever-growing collection of licensable 
technologies! Visit the site to i; . .vse currently available technologies or to learn more about what we might be able 
to develop together as resear.' ■ ra-'tners. 
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(b) (6) 


From: 

Sent: 

To: 

Subject: 

Attachments: 



Thursday, October 18, 2012 12:12 PM 


Tern Transfer 

Enciypted DNA tags (UNCLASSIFIED) 
Encrypted DNA Tags Overview Vl.pptx 


Importance: 


Hicjli 


Classification: UNCLASSIFIED 
Caveats: -FOUO 

Dear NSA Tech Transfer folks. 

Our bio folks have come up with a DNA based marking technology which can be used for anti¬ 
counterfeiting, supply chain tracking, other places where you want to verify that something on one 
end is the same as at the other end, etc. Perhaps could even be used to mark computer chips to 
ensure they are not counterfeit 

They are looking to see if anyone in the 1C would have any interest in using/co-developing its 
application. 


Please let me know if you would like some more information on it. 



Importance: High 


Classification: UNCLASSIFIED 
Caveats: rOU© ~ 

Gentlemen: 


1 
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This project to create unbreakable DNA tags to ensure item "authenticity" is a high priority for us to 
get funded. We feel it has tremendous potential. Can you help us? You may forward this as you 
deem appropriate. 

DESCRIPTION: . * „ 

Edgewood scientists have exploited DNA's intrinsic ability to "store" information to construct small 
unbreakable DNA tags that can be affixed to materials to ensure chain of custody and authenticity in 
the field. These nano-scale devices can transduce the presence or absence of a very specific DNA 
sequence (information) into a readily-observable property (light) without the need for hardware 
beyond a blue penlight. We have demonstrated the immobilization of these strand-displacement 
devices on a nitrocellulose membrane and further established the selective activation of these 
devices through the addition of the correct "message" DNA sequences to a drop of buffer applied to 
the surface. This DNA tag represents a significant improvement over currently employed DNA tags 
because it does not require time consuming interpretation in a sequencing laboratory at high 
expense. Instead a DNA tag can be read within minutes in the field through the use of a disposable 
test kit the size of a stick of gum 

We propose to deliver a tamper resistant DNA tagging system that can be read with small hand held 
assay costing $5. The project will demonstrate the secure nature and perform a pilot study on a 
collection of DNA tags and effectively demonstrate utility and cost effectiveness in comparison to 
currently employed strategies 

Classification: UNCLASSIFIED 
Caveats: FOUQ 


Classification: UNCLASSIFIED 
Caveats: FOUQ - 


2 
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, ^ US ARMY ^ 

RDECOM^ 



rECHNOLOGY DRIVEN. 






Encrypted DNA (EDNA) 
ircode Technology 
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ECBC’s new DNA Encr tion Program will be able to provide the 
ultimate encrypted-DN solutions designed to provide the highest level 
of security. From mark j individual items to authenticating secure 
government docurrient 

The Advantages of DNA Encryption Markers: 

• Highly resistant to reverse engineering or duplication 

• Verified with cheap, disposable hand held test kit 

• Unique tagging is possible to achieve ‘one-time pad’ security 

• Covert or overt, DNA sequences are acceptable forensic evidence ; 

• Custom DNA marks and strips can be created for specific needs [ 

• Compatible with a wide range of handling and manufacturing processes | 


WARFIGHTER FOCUSED. 



nmercial vs. ECBC EDNA 
Barcode Technology 



Requirements 




pmmercial 
A Barcodes 




Security 

High (single level) 

High (multiple levels) 

Time 

2 week, off-site verification 

10 minutes, on-site verification 

Cost 

Expensive for routine use - PCR, 
custody chain to lab 

Inexpensive - disposable assay 
strip can be made for pennies 

Resources 

Requires laboratory 

for definitive verification 

On-site results using test strip, 
assays available for fielded PCR 

Production 

Commercial/Foreign 

Commercial or DoD secure 


WARFIGHTER FOCUSED. 



Price, operational load 
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Higher Lower 








. inuiiinii^ 


Swab tagged item 
and place in 
hybridization 
Pouch with test 
ticket 




Test tKket contains 
array of multiple 
readout complexes 


Smartphone ^ 
Image ticket 


f 


Co-incubation with 
correct messages 
develops the 
correct patteriii 



"Peel and stick" 
disposable filters enable 
flash and camera to 
detect fluorescence. 

Verification of 
Pattern in software. 

Verification of item in 
~2o minutes 

WARFIGHTER FOCUSED. 











Objective : Secure and increase end-usei confidence in the 
supply chain by developing high assurance DNA 
anticounterfeiting marks and a disposable cheap means for 
their verification. 

Description of the effort : An algorithm be developed to 
generate a pool of short DNA sequences i riese sequences 
will be used to drive the independent deveit i inent of pixels on 
a detection strip. Complex mixtures of these sequences will be 
used to mark an item. Pattern formatio; on the strip will 
require only application of the DNA from th? lem. 



Benefits : An inexpensive means of verification enables more 
frequent testing and higher confidence in the supply chain. 
Technology is adaptable to existing "DNA ink" 
nanoencapsulation technologies and printing methods. 
Pattern on test strip could be both hunian-readable and 
machine-readable. Additional layers of set niity easily applied 
down to encrypting information in the barcoqe on a per-item 
basis. 


Major Tasks: 


Task 1 
Task 2 
Task 3 
Task 4 


Deliver validated design rules 

Synthesize flourophore-modified oligos 

Select material for test ticket, incorporate DNA tag into ink 

Technology Demonstration 


12 months 24 months 



Challenges: Cross-talk between sequences/pixels is 

possible. Deliberate contamination could render DNA marks 
unreadable. Copying of DNA marks while expensive and 
exceptionally difficult could be possible. 

Maturity: Working 2-pixel proof of concept 



WARFIGHTER FOCUSED. 
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, ^ US ARMY 

M RDECOM^ 



TECHNOLOGY DRIVEN. 


iTER 





Spotfluorescent oligo on ticket, 
0,3pLof lOOpmol/fjLsolution in 
(liH20. Let dry. 


Wash in shallow pan of diH20 1 
hour to remove unbound oligo. 


Overlay fluorescent spots with 0.5pL 
of 100pmol/(jL quencher (with 
10mM MgS04). Spot appears pink, 
no longer fluorescent. 


Quencher 1 added to 
Fluor 1, Quencher 2 
added to Fluor 2. 

Tested Q1 on F2 / Q2 on 
F1 - doesn’t quench 
effectively and washes 
away overnight leaving 
behind a fluorescent spot 
(does not hybridize to the 
fluorescent strand!) 


Immediately wash overnight in shallow pan 
of lOmM TRIS, 4mM MgS04, pH 7.7. Spot 
is less pink, still nonfluorescent. 

Air dry, then ready to test. 


WARFIGHTER FOCUSED. 






Test ticket resolving 2 c 
method saw no crosstc 



Buffer control 

(TRIS/MgS04) 


Oligos at 5 pmol/pL 


iferent oligos using the strand displacement 
. with signal appearing in under 5 minutes 



OligoA OligoB OligoA&B 


Blue backlight 580nm filter 


t=5 min 


WARFIGHTER FOCUSED. 
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From: 

To; 

Subject: 

Date: 



NSA Technolog, Detects Intermediary Computers on Network 
Tuesday, September 11, 2012 10:11:05 AM 


(b) ( 6) 


To whom it may concern, 

I am looking for any and all information you can provide me on the technology that detects intermediary 
computers on a network. If it helps, I am a subcontractor for the Department of Energy. 


Thanks, 


hGISSP- 


IT Manager, Cyber Security 

Information Security Site Manager (ISSM) ‘ " 

National Nuclear Security Aciministr^ior>'srKapsas Cfty Pleht’ 
Opera ted by Honeywe ll.FeGleTa1 M 9 nufatturing. 8 t Technologies, LLC 
Office: _ . . • ' 

Pager: ! . • ‘ ' 

Blackberry: | I 
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From: 

To; 

Cc; 

Subject: 

Date: 


I -T 

Tech Trans te: 

I - 

USSTRATCOM interest in Tech Transfer Program 
Tuesday, Octobe- 23, 2012 4:50:47 PM 


(b)(3)-P.L. 86-36 




Hello T IP rcprcsentatn c. 

Here at I'S Strategic Command w e have recently begun contract with an University Affiliated Research Center 
(UARC) with Nebraska Univeisii\ Within this UARC we have a set of USSTRATCOM Core Conipeteticies that 
the university will research; miu li like the NSA key areas of expertise (acoustics, conununications. advanced 
mathematics, computer technofiLW etc) 1 would like to expand on ways that the USS 1 RAl'COM UARC would 
conduct collaborative research w iih NSA. 1 heard about this in "The Ne.xt Wave" Vol.l9, No..3, 2012 magazine. ()1 
particular interest, woukl be the ( imperative Research and Development Agreements (CRAD.Ws). W'ho would be 
the best person to talk to concenimg establishing joint research and development elfoits'.’ 


V'l, 




(b)(3)-P.L. 86-36 

1 1 


CWMD Program AtiaK st 

USS fRATCOM. .185 (. WMD 
Canabilities Inteuration 

. . • • • 





"Great discoveries and improveinenis invariably 

involve the cooperation of maii\ imnds." —Alexander (..irahain Bell 
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(b) (6) 



In ihc past, my squadron had an aciccmenl with NSA lo share applications. 


We would like lo obtain authoi i/aiion to use the Ibllowing NSA applications: 
SIMP. Niagara Files. RYA, G1 \I .\I.X, IbEX, and Renoir. 

The only application that exist.s on Muir website is Renoir. 

W'liat is the current process to i ci|uesi these NSA applications'.^ Do you have 
a standard Technology Fransfei sharing Agreement form'.’ Or do we just reuse 
a past agreement spelling out thc'-c applications''' 
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(b) ( 



Attached is a draft Tecimolog} 1 laiisfei Sharing Agreement that we would like 
to initiate. 


At your convenience w c'uldyou :e\iew it. and let us know it it acceptable 
before we send it up for coord inaiH'ii and signature. 
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(b) (3)-P.L. 86-36 
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From: 

To; 

Subject: 

Date: 


Tech Transfer 

UMD/NSA 3t. Invention Disclosure (UMD PS-2013-085) 
Friday, September 06, 2013 2:04:25 PM 


(b) (6) 


Good Afternoon, 


Our office has received an invention disclosure which lists an NSA employee as a co-inventor. Below 
is the pertinent information: 


UMD Reference No 
Title of Invention: 
Inventors: 


Sponsor: 

NSA Award No.: 


PS-vii,3-085 


(b)(3)-P.L. 86-36 




. 



(b) (6) 


N'-A 

H9;:, 3012C0256 


Could you please lei me kn: nv who in your office my point of contact would be? Thank you very 
much for your assistance. 

(b) (6) 

I .- 

Coordinator 

**PlGase note our new ac s’* 

Office of Technology CommcK alization . • • ‘ 

University of Maryland ^ ’ 

2130 Mitchell Building , . • * ’ 

College Park, MD 20742 _ . • ’ 


www.otc.umd.edu 
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(b) (6) 


From: 

To; 

Cc: 

Subject; 

Date: 

Attachments: 

Hi, 

I'm hoping someone can give me some guidance for reporting inventions supported by the NSA. I 
work at Stanford University m the technology transfer office and am responsible for government 
reporting per Bayh-Dole. A new technology was recently disclosed to our office and the disclosure 
indicates support from the KSA. I have attached the section of the contract that discusses the 
reporting of inventions. The section indicates that the contractor should submit a DD882 to the 
Director, NSA/CSS with a cofe, to the Maryland Procurement Office, However, this falls under 
Section H.2 which deals witli contract Administration and Closeout Guidance. Is there any reporting 
that needs to be done now should the DD882 be submitted only when the grant ends? Also, can 
you please send me the cciit,3(:t information for the individual who should receive Bayh-Dole 
compliance documents. 


Tech Trans/e' 

:m; 

Bayh-Dole reporting for NSA 
Thursday, August 21, 2014 6:28:19 PM 
compliance re c . enents 14-2S6.bmp 


Best regards, 


^ • • 

Compliance Manager 


(b) (6) 


loi 







I),., in (e) Report of Inventions and' Subcontracts (Form 00882) . Pursuant to the Patent Right?, Cjause of this 

contract, the contractor shall submit the DD Form 882 to the Director, NSA/CSS, ATTN:|- ..iR3. 9800 Savage 

Road, Ft. George G. Meade, Maryland 20'?b5-6000, with a courtesy copy to the MPO (ATTN; BA331 I l< 

Maryland Procurement Office, 9800 Savage Road, Fort George G. Meade, MO 20755-6000). | - ~| 
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From: 

To: 

Subject: 

Date: 



Bluescope 

Monday, December 15, 2014 12:38:45 PM 


(D) (6) 


What do I need to get a TTA Im Bluescope? 

We ciiiTently have one ihoughi anoiliei team member that has leli and need to gel one in place lor m> sell'. 
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(b) (6) 


From: 

To; 

Subject: 

Date: 

P" 

Tech Transfs 

CRADA / PLA agreement inquiry 

Friday, June 20, 2014 11:10:56 AM 


Hil 


(b)(,2)-P.L. 86-36 


Is it possible to cxtiilinn whether oi not someone lias worked with the government under a CRADA agreement il 
they claim to have done so? 


The individual's name is | | Here is what | R eleased as public information: 

^-1 * * . 

|lias 16 yeais expeneiiee developinfi anji-lraud tecRnol,ogy related to netw ork transactions and has 

previously 'vdilfed wuh the US National Security Agehc*\'anider a c'o*-Operative Research and Development 
Agreement and Patent 1 ic’ensi? Aiw eement to develop and coninlcfcitilize network security related technology" 

‘ . * • . 

* • • * • * 

I'm in the public sector ;is an in\ e^tor and I'm looking to inqtiire-il'.tlie above claim can be'dermitely conhrmed via 
website, email or phone call? ' * . / . 


Thanks. 




(b) (6) 


Sent Ironi my iPad 
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(b) (6) 


From: 

To; 

Subject; 

Date: 

Attachments: 

Dear Sir or Madam, 

I am contacting you from iiie Office of Technology Transfer at George Mason University 
(located in Fairfax, VA). WTite I know that your office typically handles out licensing of NSA 
developed technologies I am contacting you because we have a technology that I believe 
would be of interest to tiv' NSA. Would someone in your office be able to direct me to an 
appropriate person in the NsA that might be able to evaluate possible Interest in our 
technology? The descripli^ m of the technology follows and I have attached a copy of the 
issued patent. 

Our technology detects the size, order, and timing descriptions of website packet data to 
generate a unique "fingei i.'Mrit" of each site visited over a secure network. The fingerprints 
are used to search and identify websites inside the encrypted traffic generated by users over 
time, allowing companies K: identify web traffic. What would otherwise be impossible to 
detect on a secure netwm k becomes available with this technology by "matching" the 
fingerprints before and at’pr the network to identify communication. Variations on this 
technology exist, but none are able to generate fingerprints with background noise and 
dialogue from the servei. 

I appreciate any help you an give. Please let me know if you would like any additional 
information or have any questions. 


With kind regards, 




From the Office of Technology Transfer, George Mason University, Website Detection Over a Secure Network, 
GMU 10-023 

Wednesday, September 17, 2014 10:45:01 AM 
GMU-10-023P : H-05-13 Issued Patent.odf 
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US008726005B2 


(12) United States Patent 

Stavrou et al. 


(54) 

WEBSITE VLAK HING B \SED ON 

NE rWORK rR\l FIC 

(75) 

Inventors: 

.4ngelos Stavrou Springfield. V.4 (US): 
Mohammed A. Alluisscin. McLean, V.4 
(US); Brian Sanders. Manassas, V.4 
(US) 

(73) 

.4ssignee: 

(Jeorgt Mason Intellectual Properties, 
Inc.. 1 airfax, VA i 1 S) 

( * ) 

Notice: 

Subject to any di -eiaimer. the term of tins 
patent is extendcil .t adjusted under 45 
U.S.C, 154(b) b\ : 46 days. 

(21) 

.4ppl. No.: 

12/965.413 

(22) 

Filed: 

Dec. 10. 2010 

(65) 


Prior Publieation Data 


us 201 1/0:^14269 A1 Dec 22.2011 

Related ll.S. Applkatidn Data 

(60) Provisional application No (>1 2H.‘5.420. Hied on Dec. 
10, 2009. 

(51) Int. Cl. 

H04L 29/06 (200(.ol) 

(52) U.S.Cl. 

USPC . 71.V.150: 726/.42 

(58) Field of Classificarion Scat cli 

USPC . ■ 1.4 150; 726/30: .470/390 

See application file for com|ilcie search hislorv'. 


(56) References ( ited 
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(57) ABSrR.4CT 

A websile fingerprint is generated that characterizes network 
traffic associated with a w ebsite as a website traflic fingerprint 
that includes size description(s). order de3criplion(s). and 
timing description(s) of packet traffic for the website, .4 web¬ 
site monitor generates webstitc tracc(s) of packet statistics, .4 
correlation processor correlates a sequence of packet statis¬ 
tics from the website trace(s) with the size description, the 
order description, and timing description found in the website 
traffic fingerprint(s). 

23 Claims, 7 Drawing Sheets 
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WEBSITE M ATCHIM, BASED ON 
NETWORK TK M I l( 

CROSS-REFi:RENCE H ) Ril.ATED 
APPI .IC.ATIONS 

lliis application claims the bciiclit ol' IJ.S. Provisional 
Application No. 61/285.420, filed Dec. 10. 2009, entitled 
“Exposing Encrypted HT 1P Traflie e\ cr \ PN Using Pattern 
Lettrning.” which is hereby incorjuit iietl by reference in its 
entirety. 

BRIEF DESCRIP 1 ION ()1 IMF: SEVERAL. 

VIl/WS OF THE DK WVINGS 

FKi. 1 is a plot show ing a small Mih-scction of 100 packets 
from two separate web requests to different websites. 

FIG. 2.4, FIG. 2B and FIG. 2C tire graphs of minimum and 
maximum arrival times foi website packets. 

FIG. 3 is a diagram of an extimple matrix built from a 
sample set and a fingerprint as pci an aspect of an embodi¬ 
ment of the present invention. 

FIG. 4 is a flow diagram ofprocc'-. ter generating a website 
fingerprint as per an aspect of an embodiment of the present 
mvention. 

FIG. 5 is a block diagram of a w eb-.iie detc’ctor 500 accord¬ 
ing to aspects of an embodiment ol liie invention. 

FIG. 6 is an expanded block diagram of a correlation pro¬ 
cessor 540 according to an aspect el an embodiment of the 
present uivention, 

DETAIL.F.D DESCRIPTION < )1 EMBODIMENTS 

Embodiments of the present in\eniion characterize net¬ 
work traffic associatcxl with a website as a website traffic 
fingerprint that includes size, order, and timing statistics 
descriptive of packet traffic for the website. Further embodi¬ 
ments use the characterization to detect network tratiic asso¬ 
ciated w ith that individual website regardless of: whether the 4i 
packet data is encrypted or in the clear; and/or whether the 
packet data is mixed w ith other packet data. 

Embodiments of the present in\ ei.iii m determine informa¬ 
tion about web traffic inside a Virtual Private Network (VPN) 
tumiel. Specifically, some embodiments of tlie present inven- 4 
tion search for fingerprints in cneiypted traflie to enable 
determining infomiation about w eb traffic inside a VPN tun¬ 
nel. 

,4 fingerprint in accordance Wiili embodiments of the 
present invention includes data thai characterize the conimu- .s 
nication of information to and/or Irom a w^ebsite. In some 
embodiments, the data may include the size of packets, the 
ordering of packets and the timing > ■ 1' packets. 

Embodiments may analyze multiple independent streams, 
and handle background noise or multiple sessions inside the 5 
same tumiel. Embodiments may uFo identify traffic from 
specific websites outside ofVPN l.inncls. 

Virtual Private Networks, or 4 1’N s. have become a com¬ 
mon extension of many corporate and home networks. They 
allow disjointed entities to communicate in a very cost effi- 6 
cient mamier. by using the Intenici. Since this traflie can be 
very important to the users, the sccui ity ol 4' PN’s should be 
analyzed and well understood. In many cases, the algorithms 
used arc very well tested and con-'kicred mireasonably diffi¬ 
cult for an attacker to penetrate. E mbodiments of the present f 
invention analyze web traffic without attacking the encryp¬ 
tion directly. 


2 

The usage of encryption to protect data pnn ides confiden¬ 
tiality for data being sent through the tunnel. The inability to 
read data however, docs not guarantee that something usclul 
cannot be learned by analyzing a flow of data. For example. 

' encrypting communications beuveen two points does not 
hide the fact that conmiunication is taking place, nor does it 
hide the amount of data that w as trmisferred betw een the tw ii 
points, fherefore. it may be important to imdersland what is 
protected when using a secure conmiunication method. .4 
" lack of this type of understanding may be more dangerous 
than even an unsecured conmiunication. as users may be 
working off a false assumption of anonymity. 

The ability to use the characteristics of the transactions 
- taking place across a VPN has provided multiple different 
areas of research. Using these teclmiques to analyze web 
traflie may reveal the source or destination of a communica¬ 
tion. Patterns in the stream may be used to classify the type of 
traffic inside the tunnel. Similar data leakage may be used to 
ii] analyze Voice over IP (4''oIP) traffic to detenninc the language 
or recognize specific plirases. These me all examples of how 
the characteristics of an encrypted stream may still provide 
data. 

.According to embodiments, specifically in the case of ana- 
!5 lyzing Hypertext Transfer Protocol (HTTP) traffic, one may 
determine the websites \ isited under the assumption that only 
a single user’s traffic is in the tuimel. .Although some VPN’s 
arc intended for single users, it is also very conurton for 
VPN’s to carry traffic of many users, or for a single u.ser to 
to produce additional traffic on tlie same link. In some cases, it 
may be difficult to separate out individual flows of data for 
traffic contained in the same mnnel. Embodiments of the 
present invention overcome this limitation. 

.4 method that directly addresses the ability to analyze 
t5 hypertext transfer protocol secure (https) traffic uses charac¬ 
teristics of the https protocol to assist in analyzing the cap¬ 
tured flows, file main element used is the download of html 
pages, followed by overlapping requests for the remaining 
objects. The ability' to discern tliis html file provides a means 
.1 of fingerprinting websites. Further details might be gained by 
looking at the number and size of additional objects dow n¬ 
loaded follow ing the html section of the website. These can be 
categorized separately due to different source ports making 
the request for each object discemable even when multiple 
5 objects are being downloaded concurrently due to the https 
protocol encrypting each stream individually. 

The ability to fingerprint websites based on the https pro¬ 
tocol behavior inherently depends on the ability to separate 
out a single stream of traffic. .As long a single user is making 
0 requests that do not overlap with other traffic, the w orkings of 
the protocol may be seen. When you apply additional requests 
or background traffic, this may become less clear. The 
assumption in these ca.ses may be that html w ill never overlap 
with objects, due to the requirement that the html be fully 
.s downloaded before the objects are determined. However, if 
tliere are multiple browsing sessions included in the same 
tunnel, they could overlap making the size unrecognizable for 
either request. 

In some cases, a setup may consist of a single userprotect- 
(I ing http traflie with a secure shell (SSH) tuimel to a remote 
location. SSH is a network protocol that allow s data to be 
exchanged using a secure channel between two networked 
devices. .According to embodiments, a third party' may ana¬ 
lyze sites by \ iewing the traffic between tw o encrypted end- 
.5 points. Profiles may be created for websites. Different statis¬ 
tical methods may be used for comparing the SSI. traffic to the 
database of known and gathered characteristics. 
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Embodiments of the ins'ention in ovide new mechanisms 
for analyzing a capture file, Assun]piioii> thtit each individual 
request can be separated using timing may not be valid. Some 
embodiments overcome theassumpt i, m that hlnil may need to 
be sepcuated from objects. .According to embodiments, deter- 5 
mining these divisions may not bo iiovessary to detcnnine 
when a new website is \ isited, Sonio methods of comparison 
assume that only a single website oxmls in the capmred com¬ 
parison trace, and therefore may bo compared to database of 
websites. Alternative embodiment^ handle multiple requests, u 
backgroiuid noise and multiple owi lipping flow’s in the same 
tuimel. 

According to embodiments, a daiabase of the Internet (and 
parts thereofj) could be created. '1 his daiabase miglit require 
volunteers profiling websites, and a modest amount of storage i: 
(e.g. 13 GB of storage), llie feasib;lit\ of such a daiabase is 
may be useful in multi-fiow anah xi' ih;it uses fingerprints of 
desired websites based on size and liming. 

Embodiments may include: the ability to detect individual 
page loads based on the timmg separal ion between pages, and 2i 
the ability to detect TCP handshake^ and closings by analyz¬ 
ing the size of the packets. In the case ofa single user, all data 
during a page load may be compared to a tingcrprinl. Accord¬ 
ing to embodiments, fingerprints ma\ provide an ability to 
detect pages in the presence of background noise with com- 2 
plex matching. 

Stream .Analysis for Multiple Escio 

Useful information may be dcierminod from encrypted 
traffic. However, embodiments nia\ need to use packet char¬ 
acteristics in a way that is not Ilow dependent. Basically, -t 
embodiments may not assume that all packets from a single 
request are be grouped together. W ilh this in mind, the fol¬ 
lowing sections will discuss ht'w embodiments may use 
packet size, timing, direction, and order to create How inde¬ 
pendent website fingerprints. .t 

Packet Size 

lb allow for packet si/e to remain releeanl when multiple 
connections may overlap, the set of data that may overlap in 
a fingerprint may become more important. Fingerprints ofa 
w ebsite may need to contain ItigliK unique sizes, which indi- 4 
cates that not all packets may be relevant for a fingerprint. 
FIG. 1 is a plot showing a small ^ub-^eelion of 100 packets 
from two separate web requests ti ’ different websites (netflix 
and newegg). 

One observation is that many packets in these transactions a 
are at one of the extremes of packet 'i/c. Transmission Con¬ 
trol Protocol ('fCP) is one of the care protocols of the Internet 
Protocol Suite that provides the service of exchanging data 
directly between two networkhosi'. 1 ( P eonueclions have a 
maximum packet size, and both Iran •.actions have many pack- 5 
ets at Iliis max. Secondh. TCP ivlics on acknowledgement 
packets, which comprise the bulk .a' the minimum packets 
seen in both transactions. These iiiiiiimura and maximum 
packet sizes may provide very litlle information as to which 
w ebsite is actually being visited, •.iiiee they may not be added : 
all together. If these packets are iix liided in a fingerprint, they 
are likely to increase I'alse matclie. more than provide cer- 
taintv' of the intended w ebsite. In the case of the plot in FTCi. 

1. only 20 packets out of the 100 -.liown were between the 
minimum and maximum packet si /o-- I liercfore up to 80% ot i 
this sub-section would match almvsi any other site it all 
packets were used. 

Using this observation, embodiments may make a size 
portion of the fingerprints based n an "interesting” packet 
size range, w'liich excludes maximum sized and minimum i 
sized packets. Tire tw o traces in 1 U t 1 are much more unique 
when only this section is viewed 1 his may pro\ idc a much 
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more specific fingerprint and reduces false positives. .41so. 
when every packet is not needed for a fingerprint, the effect of 
re-transmissions on detection can be reduced. Interesting 
packets may be defined as any packet above approximately 
400 bytes and below approximately 750 to 1000 bytes. Inter¬ 
esting packets are also referred to as fingerprinting packets. 

Timing and Order 

A second available characteristic w hich carries llirough to 
the encrypted stream is the timing of the packets. Generally 
I the round trip time ofa packet is dependent on the location ot 
the person accessing the server, Tliis round trip time may not 
vary greatly betw’een many sites, and requires the ability to 
associate a request with a response. Therefore a liming vari¬ 
able may be used wdiich is both more unique per w ebsite. and 
1 not dependent on the ability to associate a specific request 
with a response 

To accommodate these restrictions, timing measurements 
between arrival times of interesting packets may be used. To 
correctly analyze timing in this way. a third characteristic of 
:i the traffic, the order of interesting packets, may be used. The 
Interesting packet sizes should arrive in the same order for 
inter-arrival times to be relev'ant. The reduced number of 
packets due to limiting analysis to interesting traffic should 
make this possible. The accuracy of this process may rely on 
V the arrival times between multiple sites to var>' more than the 
round trip times mentioned earlier. To test lliis. interarrival 
time minimum and maximum timings for twenty similar 
websites were graphed. Tlic minimum and maximum arrival 
times for each packet are graphed per website. FIG. 2A show’s 
0 the results for all websites, indicating that some websites have 
a very long range, and often would not match incorrect sites. 
FIG. 2B show s a section of the 20th packet from all websites 
tested. Here it becomes clearer that min-max pairs have a 
distinct range. Finally FIG. 2C shows a very small section of 
s packets at the very bottom of the trace. These packets high- 
liglit that a very tight timing range can exist at any give point 
in the sequence. I'his tends to indicate that even if there is 
some over lapped timings for some sections of websites: it 
appears unlikely that the same website will contain overlap- 
u ping timings for every interesting packet. 

During fingerprint generation, the time betw een interesting 
packets may be recorded. These values may be stored for each 
pair: therefore 19 timing values may be needed with the 
fingerpnnt if there are twenty packets in the fingerprint, .^fter 
5 multiple runs, the timing between each pair of packets may be 
analyzed to fmd a minimum and maximum arrival time for the 
website. Therefore, website fingerprints may consist of only 
interesting packets, in a specific order per w ebsite, with a set 
of timings between each packet. 
iO Packet Direction 

.4nother variable available with encrypted traffic is the 
direction of the traffic. Divide the stream into two directions, 
inbound and outbound. The inbound traffic would be all traf¬ 
fic arriving faun the Internet towards the client, wliilc the 
15 outbound traffic is the requests out from the client to the 
serv'er. These two directions may be view ed as independent 
streams, since it may be difficult to reliably correlate requests 
to responses in a multi-user scentirio. Comparing the inbound 
and outbound streams can provide tw o different observations, 
so First, the outbound packets may have a more reliable tim¬ 
ing. The outbound packets may have very little network 
equipment to traverse before arriving at the monitoring point. 
The latency between the client and the\ PN entry may there¬ 
fore be low, when comptired to latency times across the Inter- 
55 net. Tills low latency should create a more stable timing 
variation betw’een packets, .\dditionally. requests from the 
client should not experience as much variance due to luglier 
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load due to the simple nature of tin.- i equesl verses a serx'er 
providing files and database access 

Secondly, the outbound traffic ma\ be more likely to arrive 
in the expected order as seen in tlie lingerprint. Again, a 
smaller amount of network equipment to traverse should 5 
decrease the chance of an out of order arrival, .\dditionally. 
the requests sent by the client are le^s hkely to be broken up 
mto unexpected sizes, w hile a sei \ ci might provide some 
information differentK' according ir. its current load. 

Due to these reasons, some cmb.'dimcnts may locus on m 
attempting to detect w ebsites in enc r> pled traffic based solely 
on the outbound stream of traffic, rhi-. may provide the addi¬ 
tional benefit of reducing the numbei ol packets which must 
be analyzed, as most web transactions have many more 
inbound packets than outbound. l.s 

Ihe focus on outbound traffic coiiid allow for one param¬ 
eter defined earlier to be relaxed, the interesting packet size 
range. Inbound traffic has many mtixintuni size packets, w hile 
outbound traffic has relatixely few 1 herefore. embodiments 
may re-definean interesting packet size to include these pack- 2 ii 
cts to obtain more fingerprint information, ifonly web traflic 
is present on the link to be analyzeil. 11. howec'cr. there may be 
other protocols on the link, a range may still be necessary 
since other protocols may result in large outbound packets. To 
ensure the method is more robust, embc.dimcnts may keep the 2,s 
range as defined earlier. 

Multi-User Search Process 

.'k detection mechanism may be titiii/ing using previously 
described metrics in a multi-flow environment, .k website 
detector may be viewed tis two siibeomponents. the finger- .to 
print generation mechanism, and the eomparison mcchtmism. 

The fingerprint mechanism may be provided with many 
stunples of a web request, and subsequently generate website 
fingerprints, llie comparison meehanism may be provided a 
trace file to be analyzed and website fingerprints for sites to be .t.s 
identified. The comparison mechaiii'iii may then detennine if 
any sequences in the trace matcli the provided fingerprints 
and rettirn the results. The follow ing sections will describe 
how these two meclianism work. 

Fingerprint Generation. 4ii 

To generate a fingerprint, trace likw of successful visits to 
the websites to be fingerprinted slicnild be collected. In some 
embodiments, it may be udvantagei u!-- that the only traffic in 
the trace belongs to the desired wciwiic. Fingerprint genera¬ 
tion may require a large number ul traces to ensure the fin- 45 
gerprint can accurately reflect the site under varying condi¬ 
tions. 

.ks an example, this inl'onnation may be gathered using two 
Lmux machines, with an OpeiiX I’N connection between 
them. One end w ould be the “client ' end of the connection, so 
while the other would nin a web proxy listening locally on the 
tunnel interface. The client may make w eb requests through 
the tumiel to the proxy server on tiic other side. Using tep- 
dump. capture files may be created . ■ 1 both the dear text, and 
encrypted traffic, at the same time I lav ing both traces allows 55 
for using the encrypted traffic loi- lingerprint generation, 
while still maintaining the clear text to analyze any unex¬ 
pected behavior. 1 his process may be scripted. In an example 
test, this process w as run to gathei 1' K > traces for each website 
to be analyzed. (.)nce the capture likw are available, a finger- 6ii 
print may be made for each site. 

Txample traces for a specific site may be made accessible 
to the fingerprint generation mech,iiii''in. bach trace may be 
divided into the inbound and outbound directions, .ks 
described earlier, some embodiiriciiis may’ only focus on the 65 
outbound direction traflic Foe the purposes ol describing this 
particular embodiment, in the reiiiaimng steps only the oul- 
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bound traffic is used, .kddilionally. embodiments may focus 
only on the interesting, as defined earlier, from each of these 
traces. 

Trace files w hich contain packets with the correct direction 
and size may be analyzed. Traces may be analyzed and a pair 
of vectors created to describe each trace. The first vector may 
contain the size of each packet, in the order they are seen in the 
trace file. The second vector may contain the time at which 
each packet arrived. The length of the vectors may depend on 
the number of interesting packets in the corresponding trace 
file Ihev were generated from. Since the index may represent 
the order of the packets, these two vectors may quickly allow 
the determination of arrival time and size of packets accord¬ 
ing to their order of arrival. Ihe two vectors may need to be 
keep consistent, therefore any alterations or deletions may 
need to be completed on both vectors the same way. 

Once the vectors are created for test runs of a site, vectors 
may be grouped together by vector length. These groupings 
may represent multiple possible sub-fingerprints for a single 
website. Since timing may be defined as the difference since 
the last interesting packet, the number of interesting packets 
may have a large impact. Therefore these sub-fingerprints 
may allow for some variation in expected responses while 
keeping the timing data a viable means of comparison. 

Hach of these groupings may now undergo processing to 
create website fmgerprintfs). The processingmay accomplish 
two goals. First, network errors or anomalies may be removed 
from test sets. Fingerprint generation may be automated to 
allow for large number vtf runs. However, a mechanism may 
be necessaiy to ensure that atiy errors in page loads or network 
problems do not corrupt fingerprint(s), A first step may be to 
remove detectable errors to ensure a clean fingerprint(s), 
After tills process, there may still be some variation due to a 
website itself. For example, there might be some page loads 
which are requested in slightly dilferent order, wliich is com¬ 
mon for the page. Tlierefore. it may be useful to reduce the 
sub-fingerprints of group(s) down to similar portions of a 
requests while still keeping the fingerprint imique enough to 
match. 

■kccording to embodiments, one reduction reduction may 
focus on removing vectors that fall into these groups, but are 
very far apart from any other vectors. These may be detected 
by finding a “miss rate” for vector(s) in the group. To find this, 
embodiments may start with the first element ofthe vector to 
be tested, and compare its size value to all other vectors in the 
same group, .k miss may be recorded for every mismatch 
Ibund. This may be done for every element ofthe vector to be 
tested, resulting in a miss rate for the entire vector. Tills miss 
rale may then be used in foniiula (1) to generate a miss ratio. 
The number of misses is represented by in. I he muiiber of 
elements in the current group is represented by g. The length 
of the vectors in the group is represented by 1 

(ni g) 1 n) 

Vectors containing a verv' liigli miss ratio may represent 
data which is most likely bad. but still happened to be ofthe 
correct length to lit into the group, .kiiy vectors that have a 
miss ratio over a set tlireshold may be removed from the 
group, as they may represent errors that could corrupt the 
fingerprint. 

According to embodiments, another reduction may toeus 
on correcting for small variations wliich max' be conuiion due 
to factors such as dynamic web content, adds on to a page. etc. 
I'hese might still generate the same number of requests, but it 
is possible that some get requests could be a slightly different 
size, causing the vectors to not match every size exactly the 
same. To generate a single fingerprint representing the entire 
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group. v\hile slill allowing for these '.e.rialious. embodiments 
may remove the variable packets liom tlie fingerprints. The 
first index in the first vector may be compared to the first index 
ol'eveiy other vector in the group, 1! ilie index is not I'ound to 
match every other vector in the group, then that index may be 5 
removed from all vectors in the gioiip. This may be repeated 
for every index in the vector, remo\ ing any that do not match 
all other vectors in the group. \Mien done, the remaining 
vectors may all match, in size and sequence, 'fhe removed 
entries may represent the variable data from the website, m 
while the remaining entries mav re lire data point wdiich 
should always be present. ITieremaining vector may provide 
the size-order portion of the fingerpi im for the group. 

.4dditionally. the number of trace^ m each grouping may be 
evaluated and any grouping with les^ titan a minimum number i s 
of traces dropped. These groups mav slill be present espe¬ 
cially if they contain only a single element. A single element 
group may not have been removed b\ i ne previous methods as 
they may not have any error rate at all. but still represents data 
which needs to be removed. 20 

Finally, the timing portion ofthe fingerprint may be created 
for the groups. Each vector in a grotip may have correspond¬ 
ing timing vectors, which have been altered in the same way 
as the size v'ectors. To create a timing vector, the first and 
second entries may be comparcvl to find the time delay :.s 
between these two interesting packets, i his may be done lor 
all vectors in the group, and the minimum and maximum 
delays seen may be recorded for the timing portion of the 
fingerprint. This may be done for eaeli interesting packet pair 
in the sequence, resulting in a minimum and maximum .to 
expected inter-arrival time for all packets in the sequence. 

According to embodiments, the timing data, along with the 
size-order data, creates one sub-fiiigeiprint for the designated 
w^ebsite. A website may contain multiple sub-tingerprims. 
one for each grouping found. All siib-fingerprints together .t.s 
may create a fingerprint for the website as a w'hole. \Mien 
testing for a match, any ol these sub-lingerprints being found 
may indicate a match for the website 

Companson Mechanism 

Ihe previous sections describe how to generate finger- 4o 
prints for sites to be tested. Once ilicsc lingerpriiils arc avail¬ 
able. captured network traffic may be searched for a matching 
fingerprint. For this, embodiment' iiiav' use a comparison 
mechanism designed to look for the qualities provided in the 
fingerprints. To accomplish this, the captured packet data may a.s 
be formatted, a search matrix constructed, and the matrix 
traversed to determine it ;i matching path exists. Tlie follow- 
mg paragraphs describe embodiments ol tills process. 

First, a data stream to be tested iiiav be captured in a trace 
file. For some embodiments, rather tlitni requiring processing .vii 
to filter out the inbound data, onh outbound data needs to be 
capmred. Tliis data mav- be matlc ,nailable to a matching 
mechanism that may generate size \ ccloifs) and timing vector 
(s) as was done for the fingerprint', .\eeording to embodi¬ 
ments. these two vectors may ctniljiii only data wliich falls 5.i 
into the interesting range as defined ]ireviously. reducing the 
size ofthe required matrix and ignoring traffic which wall 
never match the fingerprint. The ic'ulting data may be in a 
similar fomial to the fingerprints, allliough many different 
flows may be present trora multiple w eh requests. 6i 

.4ccording to embodiments, after lormatting the input data, 
a matching mechanism may create an analysis matrix that 
may be used to find possible matches. When looking for 
matches, a single sub-fingerprint lioni the websites combined 
lingerprintmaybeanaly/edatatinic, 1 he matrix may contain 6: 
a colunm for each entiy in the fingerprint being analyzed. 
Each column may contains index rclerenccs to packets that 
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match the required size for the fingerprint, fhe vector con¬ 
taining the traffic to be analyzed may be traversed, comparing 
the size ofthe packet at the current index, to all indexes ofthe 
fingerprints size vector. Every time a matching size is found, 
the index ofthe test set may be recorded in the corresponding 
column in the analysis matrix. It is possible that a single 
packet size is Ibund in multiple locations in the fingerprint, 
and therefore any packet in the analysis trace may be recorded 
in multiple columns in the matrix. 

FIG. 3 shows an example matrix built from a sample set and 
a fingerprint. In tliis example, the sample and fingerprint rows 
represent size values, w'lule the index is for easy reference to 
the location in the vector. Each column ofthe matrix contains 
all indexes where the fingerprints required size is matched. 
Since the fingerprint has the same size for the first and third 
packets, these cohinms in the matrix are identical, fhe sample 
is traversed, and all matching sizes have their index stored in 
the matrix, as shown. 

Once the matrix has been generated, the matching process 
may then determine if an acceptable path exists tlirougli the 
matrix, fhe matrix may provide all packets ofthe appropriate 
size, but it may also be cheeked against the timing require¬ 
ments from the fingerprint. Embodiments start with the first 
entry in the first cohinm ofthe analysis matrix. Tins is the first 
packet that matches the correct starting size for the finger¬ 
print. The index of tliis packet allows the arrival time to be 
quickly referenced. The arrival time ofthe first packet in the 
second eolunui may be also determined. The difference in 
the.se arrival times may then be compared to a minimum and 
maximum time range of the fingerprint. If the time is not 
witliin the range, the next cntiy’ in the second colunm may be 
checked until a match is found or no other entries are avail¬ 
able. If no matches are found, the process may start over again 
with the second entry in the first colunm. again searcliing for 
any timing that is within the range specified in the fingerprint. 
If a match is found, the cohmms in the search may be 
advanced, and the matching packet used as the new^ starting 
point, and the third colunm may be searched for an acceptable 
timing value. If a complete path is found throiigli the matrix, 
then there exists a sequence of packets w Inch match the given 
fingerprint size, order, and timing. 

In the previous example show'n in FIG. 3. one possible path 
tlnoiigli the matrix is indicated as bold boxes. This path may 
assume the timingof these packets were within the acceptable 
range. If they were not. an alternate path could have stated 
with the second entry in the first colunm. 

This process may be done for each sub-fingerprint of a 
given w ebsite to look for all known variations of traffic asso¬ 
ciated with the given site. If a match is found, it is possible to 
not only return a result but to provide the packet sizes in the 
trace as well as the exact timing for the detected sequence. 

FK). 4 is a flow diagram of process for generating a website 
fingerprint. This process may be computer implemented 
using one or more computing macliincs. Embodiments of the 
process (or parts thereol) may be substantiated on one or more 
non-transient tangible computer readable medhmis that con¬ 
tain computer readable instructions that when executed by 
one or more processors, causes the one or more processors to 
execute all or part ofthe process. Examples ol'non-transient 
I tangible computer readable mediums include: solid-state 
memory, flash drives, hard drives, floppy drives, optical disks. 
DVDs. CDs. Blu-ray discs, or the like. 

.\t 410. fingerprinting packets from website request pack¬ 
ets to a website may be identified. The identification of fm- 
I gerprinting packets may include looking at the packet size ol 
each packet. Packets that have a size that is less than a mini¬ 
mum packet size may be rejected. .4 typical minimum packet 
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size may be approximately 400 b\ le. Similarly, packets that 
have a size that is greater than the maximum packet size may 
also be rejected. .A typical maxiimim packet size may be 
approximately 1000 bytes. One i l the features ol some 
embodiments is that lingerpriiitiiic packet{s) may be 5 
encrypted. 

Eiach of the fingerprinting packen s, may also have a tem¬ 
poral location within the website reqnests. The temporal loca¬ 
tion is the location w ithin the sequence ol packets comprising 
a website request. Often, the temporal location may be i 
described using a timestamp. Timeoiamp(s) may be internal 
to fingerprinting packet(s) or derixcLl from an arrival time 
measurement of the fingerprinting pccketts). 

Website traffic fingerprint(s) ni.iy be generated at 420. 
Website traffic fingerprint(s) ma\ include: an ordering l 
description, a size description, a timing description, or a 
combination thereof. The ordering description may include 
ordering data of at least two of ihe fingerpnnting packets 
determined using the temporal locath n for each of the at least 
two of the fingerprinting packets. I he size description may 2 
include size data of the packet size ol at least two of the 
fingerprinting packets. The timing description may include 
timing data of at least two intcr-paeket times for at least two 
of the fingerprinting packets detenmned using the temporal 
location for each of the at least two of the fingerprinting 2 
packets; ora combination thereof I he ordering and the inter- 
packet times may be determined using the same lingerprint- 
ing packets. 

FIG. Sis a block diagram ofa website detector 500 accord¬ 
ing to aspects of an embodiment of the invention, ('omputer 
524 is communicating w ith a Web scrxer 522 via website 
packet flow 520 through network 526 

Web site monitor 5.40 may be conligured to generate at 
least one web site trace 535 of packet statistics related to 
fingerprinting packets from website packet flow 520. Website 2 
packet flow 520 may be encrypted i ingerprititing packets 
may be a subset of the w'ebsite packet flow 520 having a 
packet size between a minimum p.icket size and a maximum 
packet size. A typical minimum packet size may be approxi¬ 
mately 400 bytes and a t\ pical max iinum packet size may be 4 
approximately 1000 bytes. 

Tlie website detector 500 uses w ebsiie traffic fingerprint(s) 
510 that describe the website packet flow 520 for specific 
websites. Website traffic lingerpriitii' i may include: an order¬ 
ing description(s) 512. a size desciiption(s) 514. a timing 4 
description(s) 516. or a combinaimn thereof The ordering 
description(s) 512 describes the temporal order of finger¬ 
printing packct(s). dhe packet si/e description(s) 514 
describe size of fingerprinting packet i s). d he timing deserip- 
tion(s) 516 describes inter-packet times between pairs of fin- .s 
gerprinting packet(s). 

A correlation processor 540 ma \ ne eonfigmed to correlate 
a sequence of packet statistic(s) fu'iii the w eb site trace 535 
w ith the size dcscription(s) 512, the order dcscription(s) 514. 
and timing description(s) 516 found in w ebsite Iraflic linger- .s 
print(s) 510. Correlation processm 5411 outputs any matches 
545 between the web site trace535 and website traffic fmger- 
print(s) 510. 

FIG. 6 is an expanded block diagram of a correlation pni- 


may need to be kept consistent, especially when processed. 
According to some embodiments, the w eb site trace 535 may 
limit the statistics to fingerprinting packets in the outbound 
direction. 

According to embodiments, grouping module 610 may be 
implemented in embodiments of the correlation processor 
540. Idle grouping module 610 may be configured to group 
size vector entries and timing vector entries by at least one 
chardcteristic. These grouping could be treated as a sub- 
:i fingerprints. Characteristics may include any type of infor¬ 
mation useful in describing an embodiment relevant charac¬ 
teristic of a fingerprinting packet such as the length of a 
fingerpriiitiiig packet, an association of the fingerprinting 
packet with particular portions of web site requests, etc. 

.s According to embodiments, miss rate processor 620 may 
be implemented in embodiments of the correlation processor 
540. Miss rate processor 620 may be configured to calculate 
a miss rate among vectors in a grouping. .4 miss occurs when 
the length of a vector falls outside a prescribed limit. The 
Cl number of misses is used to calculate a miss rate ratio, ddie 
miss rate processor 620 may remove variable packet vector(s) 
whose miss rate ratio exccxtds a miss rate tltreshold from a 
grouping. 

•According to embodiments, removal processor 630 may be 
,s implemented in embodiments of the correlation processor 
540. Size vector entries and timing vector entries associated 
with network errors or anomalies may comipt a website fin¬ 
gerprint. Removal processor 630 may be conligtircd to 
remove these size vector entries and timing vector entries 
I associated with network errors or anomalies. 

.According to embodiments, matrix processor 640 may be 
implemented in embodiments of the correlation processor 
540. Matrix processor 640 may be configured to create an 
analysis matrix 645 using the size vector 612 and the timing 
5 vector 614. 

.According to embodiments, indexing prticessor 650 may 
be implemented in embodiments of the correlation processor 
540. Indexing processor 650 may be configured to generate 
an indexed matrix 655 by indexing index size vector entries 
(1 612 in the analysis matrix 645 to fingerprint size vector 
entries that have sizes that are within an configurable error 
margin. 

.According to embodiments, matching processor 660 may 
be implemented in embodiments of the correlation processor 
s 540. Matcliing processor 660 may be configured to determine 
if a path 665 exists tlirouglt the indexed analysis matrix 655. 
The matclimg processor 660 may attempt to locate a path 
tlirough the indexed analysis matrix 655 by sequentially 
matcliing the inter-packet times between indexed entries in 
0 the indexed analysis matrix 655. 

.According to embodiments, reporting processor 670 may 
be implemented in embodiments of the correlation processor 
540. Reporting processor 670 may be configured to output a 
positive indicator 675 when the matching processor 660 
5 determines that a path 665 exists tlirough the indexed analysis 
matrix 655. 

Additional website request infomiation about a website 
could improve a website fingerprint. Packet statistics trom 
web site trace(s) 535 may be used to update website traffic 


cessor 540 according to an aspect .■! an embodiment of the 60 fingerprint(s). 

present invention. .As shown, the cioTclation processor 540 In this specification, “a and an andsimilarpltrasesareto 

includes a veclorization processor 600 configured to use the be interpreted as “at least one” and “one or more,” 
w eb site trace 535 to create size \ cct. a 612 and timing vector Many of the elements described in the disclosed embodi- 

614. Size vector 612 may mclude or.icrcd size statistics about ments may be implemented as modules. .A module is defined 
fingerprinting packets and timina ’. cctor 614 may includes 65 here as an isolatable element that perlomts a defined fttnetion 
temporal information about fingci jv'inting packets. Accord- and has a defined interlace to other elements. Tlte modules 
ing to embodiments, size vector 612 and timing vector 614 described in tins disclosure may be implemented in hardware. 
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a combination of hardware and soliw are. linnware. wetware 
(i.e hardware with a biological eleinent) or a combination 
thereof, all of which arc behro lorally equivalent. For 
example, modules may be implemented tis a software routine 
written in a computer language (siiel. as C. C++. Fortran. 
Java. Basic, Matlab or the like) or ti modeling/simulation 
pn.>gram such as Simulink. Statellow. (iNU Octave, or l.ab- 
VIEW MathScript. .\dditionally, it in i\ be possible to imple¬ 
ment modules using physical hardw are that incorporates dis¬ 
crete or progranunable luialog. digital and/or quantum 
hardware. Examples of programinnble hardware include: 
computers, microcontrollers, micropnicessors. application- 
specific integrated circuits (ASICs i. Held progranunable gate 
arrays (FPCj.^s); and complex prognimmable logic devices 
(CPLDs). Computers, microcontroller' and microprocessors 
are progranmied using languages such as assembly, C, ('++ or 
the like. FPG.\s. .\SICs and CPI I)' are often progranmied 
using hardware description language' 1 1 IDE) such as VllSlC 
hardware description language (M 11 )l ) or\erilog that con¬ 
figure coimections between internal hardware modules with 
lesser functionality on a programmable device. Finally, it 
needs to be emphasized that the ab. \e mentioned technolo¬ 
gies are often used in combination la achieve the result of a 
fimctional module. 

Idle disclosure of this patent doeument incorporates mate¬ 
rial wdiich is subject to copyright protection. 'Ilie copyright 
owner has no objection to the facsimile reproduction by any¬ 
one of the patent document or the ptitetit disclosure, as it 
appears in the Patent and Trademark Otlice patent file or 
records, for the limited purposes required by law. but other¬ 
wise resert'es all copyright rights wh.itsoever. 

While various emboditiients ha\ e been described above, it 
should be understood that they ha\ e I'een presented by way of 
example, and not limitatitm. It will be apparent to persons 
skilled in the relevant art( s) that \ .it i.'Us changes in form and 
detail can be made therein without departing from the spirit 
and scope. In fact, after reading the above description, it will 
be apparent to one skilled in the rek". ant art(s) how to imple¬ 
ment alternative embodiments. 1 Ini', the present embodi¬ 
ments should not he limited by ;in\ of the above described 
exemplary embodiments. In pariiciikir. it should be noted 
that, for example purposes, the abm c e.xplanatiou has locused 
on the example(s) analy/ing web'iic traffic. However, one 
skilled in the art will recognize iliat embodiments of the 
invention could be used to analwc other types of packet 
traflic related to other types of conimiinieations such as com¬ 
munications to mail servers, DNS 'Civ ers. ftp severs, peer to 
peer conuuuniealions. SC .ADA comiminieations. etc. 

In addition, it should be undcr'liual that any figures that 
highlight the functionality and advantages, are presented for 
example purposes only. I he discli''ed architecture is suffi¬ 
ciently flexible and configurable, suen that it may be utilized 
in ways other than that shown. For example, the steps listed in 
anv flowchart may be re-ordered im >'iily optionally used in 
some embodiments. 

f urther, the purpose ol the Abstract ot the Disclosure is to 
enable the U.S. Patent and Tradeni.uk Office and the public 
generally, and especially the scienli'i'. engineers and practi¬ 
tioners in the art who are not familiar with patent or legal 
terms or phraseology, to determine quickly from a cursory 
inspection the nature and essence d the teclmical disclosure 
of the application. The .kbstraci id the Disclosure is not 
intended to be limiting as to the sc.'pc in any way. 

Finally, it is the applicant’s intent that only claims tliat 
include the express language “nie.in' lor” or “step lor’ be 
interpreted under 35 U.S.C. 112. paragraph 6, Claims that do 


not expressly include the plirase “means for” or “step for” are 
not to be interpreted imder 35 U.S.C. 112. paragraph 6. 

What is claimed is: 

1. A computer implemented process comprising: 

5 identifying fingerprinting packets from website request 
packets to a website, at least one of the fingerprinting 
packets being encrypted, each of the fingerprinting 
packets having: 

a packet size between a minimum packet size and a 
111 maximum packet size: and 

a temporal location within the website requests; and 
generating a website traffic fingerprint tliat includes at least 
two of the following: 

an ordering description of at least two of the lingerprint- 
1 .' ing packets determined using the temporal location 

for each of the at least two of the fingerprinting pack¬ 
ets; 

a packet size description of at least two of the finger¬ 
printing packets; and 

2i I a timing description of at least two inter-paeket times for 
at least two of the fingerprinting packets determined 
using the temporal location I'or each of the at least two 
of the fingerprinting packets. 

2. The computer implemented process according to claim 
25 1 . wherein the temporal location is detennined using a times¬ 
tamp. 

3. The coiuputer implemented process according to claim 
2, wherein the timestamp is internal to at least one of the 
fingerprinting packets. 

30 4. The computer implemented process according to claim 

2. wherein the timestamp is derived I'rom an arrival time 
measurement of at least otie of the fingerprinting packets, 

5. 'fhe computer implemented process according to claim 
1, wherein the minimum packet size is less than 400 bytes. 

.35 6. The computer implemented process according to claim 

1 . wherein the maximum packet size is greater than 1000 
bytes. 

7. I'he computer implemented process according to claim 
1 . wherein the ordering and the inter-packet times are deter- 

411 mined using the same fingerprinting packets. 

8 . website detector comprising: 

a module configured to receive at least one website traffic 
fingerprint that includes at least one of the follow' ing: 
an ordering description of at least two fingerprinting 
45 packets; 

a packet size description of at least tw o of the finger¬ 
printing packets; and 

a timing description of at least two of the fingerprinting 
packets; and 

50 a website monitor configured to generate at least one web¬ 
site trace of packet statistics related to fingerprinting 
packets from a website packet flow, at least one of the 
fingerprinting packets being encrypted, each oi the fin¬ 
gerprinting packets having a packet size betw ecu a mini- 
55 mum packet size and a maximum packet size; and 

a correlation processor configured to correlate a sequence 
of packet statistics in at the at least one website trace 
w ith the size description, the order description, and tim¬ 
ing description found in at least one of the at least one 
611 website traffic fingerprints, 

9. The website detector according to claim 8. wherein the 
correlation processor includes a vcctorization processor con¬ 
figured to use the website trace to create: 

a size x-ector that includes ordered size statistics about 
65 fingerprinting packets; and 

a timing vector that includes temporal information about 
fingerprinting packets. 
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10. The website delecUir accordiiie U' claim 9, wherein the 
si/e vector and timing \ ector are kept consistent. 

11. The website detector according to claim 9. I'urlhcr 
including a grouping module conlignrcd to group size vector 
entries and timing vector entries b\ at least one characteristic. 

12. The w ebsite detector according to claim 11, wdierein at 
least one characteristic is lengtli. 

13. Tlie website detectoi according to claim 11. wherein at 
least one characteristic is an association w ith similar portions 
of website requests. 

14. The website detector according to claim 11. lurthcr 
including a miss rate processor coni igiired to calculate a miss 
rate among vectors in a grouping. 

15. The website detector according to claim 14. wherein 
the miss rate processor is tiirther conlignred to remove vari¬ 
able packet vectors whose miss rate ratio exceeds a miss rate 
threshold from a grouptng. 

16. The website detector accor.iiiig to claim 9. litrlher 
including a removal processor eontigttred to remove size 
vector entries and timing vector eti'mes associated with net¬ 
work errors or anomalies. 

17. The website detector accordtng to claim 9. further 
including a matrix processor configtiivd to create an analysis 
matrix using the size vector and the titnitig vector. 


14 

18. The website detector according to claim 17. further 
including an indexing processor configured to index size 
vector entries in the analysis matrix to fingerprint size vector 
entries that have sizes that are within a configurable error 

5 margin. 

19. Ihe website detector according to claim 18. further 
including a matcliing processor configured to detennine if a 
path exists tlirougli the analysis matrix. 

20. The w'ebsite detector according to claim 19. wherein 
111 the matching processor is configured to locate the path 

tlu-ough the tmalysis matrix by sequentially matcliing the 
inter-packet times between indexed entries in the analysis 
matrix. 

21. Ihe website detector according to claim 19. further 
i.s including a reporting processor configured to output a posi¬ 
tive indicator when the matching processor detemiines that 
the path exists through the analysis matrix. 

22. The website detector according to claim 8. wherein the 
W'ebsite trace includes at least one statistic related to finger¬ 
printing packets in the outboimd direction. 

23. The W'ebsite detector according to claim 8. wherein at 
least one packet statistic from at least one website trace is 
used to update at least one website traffic fingerprint. 
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From: 

To; Tech Transt" 

Subject; Gathering Information 

Date: Sunday, Septembe 21, 2014 1:59:33 PM 


Can you please give me inlormation about the National Security Agency - 
Technology Transfer Program? I would prefer to know every detail you can 
give and more information about the Computer & Information 
Sciences Researcl 

because I could find no contact detail of someone who can provide the 
information I like to know and do not forget to give the information I like 
to know about the Technology Transfer Program too. 
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From: 

To; 

Subject: 

Date: 

Attachments: 


Tech Transfe ' 

Retrieving Elect! onic Data During Enhanced Note Taking 
Thursday, Januery 09, 2014 1:36:27 PM 
NSA.Tech.Trer c- retreiving data,pdf 


( 


b) 


As a follow up, INADEV sent a written request to the NSA Technology Transfer Program a 
couple of months ago regar ding the above-referenced patent (summary sheet attached). I 
would like to speak with someone regarding the potential transfer of this patent as soon as 
possible. My contact information is below. Thanks. 


1 - 


(b) (£) 

Chief Lxeaifivi 

Officer 




1651 Old Meadow Rd., Suite 205 
McLean, Virginia 22102 
WWW inadev.com 
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Title: Retrieving Electronic Data during Enhanced Note Taking 

Aliases: None 

Technical Challenge: To search and retrieve data while taking handwritten notes. 

Description: This iii\ ention gives a person taking handwritten notes the ability to search 
and retrieve data contained in computerized data bases in near real time. This invention 
gives the note taker the additional ability to delineate specific terms while taking notes 
while requesting general or specific adclitional information. The invention combines 
several existing technolouies -- such as any of the existing “smart pad” technologies - to 
automatically capture and extract information and instructions from written notes while 
connecting computei data sources with the note taker’s display through wireless 
technology. 

Demonstration Capability: Sketches of the physical layout with a process description 
are available. Indi\ iduai technologies can be displayed separately. 

Potential Commercial .Application(s): There is large potential for use in differing 
markets wdiere eas\ ad hoc data entry and retrieval with key-word customization is 
needed. These diverse markets might include critical areas such as law enforcement and 
public safety, customer and sales oriented activities such as Customer Relationship 
Management (CRM i and Sales Force Automation (SFA), warehouse management 
systems (WMS), or supply and distribution chain management. 

Patent Status: Pateiii application has been filed with USPTO. 

Reference Number: 1513 
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From: 

To; Tech Transfe ' 

Subject: short visit 

Date: Thursday, November 06, 2014 3:05:38 PM 

Dear Sir or Madam. 

1 would like to have a shoi t \ isit with someone from the tech transfer office to discuss 
technology transfers. I ha\ e a badge and could meet wherever you designated. 


Thank you for your attentum to this request. 



y 






(iieclings n 


Requesting assistance in obtaining i amper Indicating l.abels and Reusable 
Tamper Indicating Seciii ity Dc\ ice- lioin NSA tor use on classified hard 
drives. 



Infonnation Security Specialist 
Army Sustainment C ommand: (i? 
AMSAS-IN 







Hello. 

I work at NASA'ARC. as a supp. ii contiaeloi willi their small satellite projects, and would be interested in 
obtaining more inlonnaiion on \oui w ide band retro rellector listed in your 2014 tech tianslei file. 



Sent from my iPad 



ioi 






Hello 

I am with the Departmciit of Dckii'-c and I am ihe lechuology maiumer for a pilot project dial establishes ihe 
continuous evaluation of cleared personnel. I saw several inteiesting excerpts about leclmology the NSA has for 
doing context relevant searchine ol liala to delcmiine relationships of data. 

1 would like to know if the Dol) i-. eligible to participate in this program or if there is another for intergovernmental 
transfers. 



Defense Manpower Data Centei (1 )\11)C) 
Office 8()()(). 400 Gigling rd., seaside CA 93955 


DMDC is on I’acebook and T\i iiiei! Check us out... 
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From: 

To; 

Subject; 

Date: 


Tech Transfe : 

CRADA Progran 

Thursday, Nove-iiber 19, 2015 10:30:18 PM 


(b) (6) 


As a private citizen, without a business of my own, nor being a member of academia, is there 
still an avenue available to me via CRADA for tech, transfer? 

I have a large collection of design concepts with wide-ranging applications and implications to 
homeland security. 

I am looking to share these designs for immediate development with the NSA, as 1 know they 
may have a direct impact on HUMINT, SIGINT, lA, and other high priority needs. 

Thank you. 

I - 1 [ (b) (6) 
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Hello, 

My name is| I'm a C i<nipuler Scientist here at the FBI. One of niy associates at the FBI here was told me 

that this would be the coixect e mail to contact regarding obtaining a piece of software known as "ghidra". Could 
you please point me in the righi dncction? 




Boston FBI, 
Computer Seientist 







Subject: from wall street journal - comment on onyara acquisition 

Date: Tuesday, August 25, 2015 6:53:31 PM 


Hi there, 

I cover technology in the Weii Street Journal’s San Francisco bureau. I saw that Onyara Inc was 
acquired. I'd like to get sonic background on the technology transfer program, which I wasn't 
familiar with until now. When was it launched? Can someone chat about the origin of the technology 
transfer program? 



Reporter 
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From: 

To; 

Subject; 

Date: 



National Secunt. Agency - Technology Transfer Program 
Tuesday, Maicl-. 03, 2015 2:34:36 PM 



Greetings, 


I recently created a servicj- liisabled, minority owned small business (Cyber Research and 
Intelligent Solutions Provitiei—CRISP) which focuses on various "disruptive technologies. 
Basically, my company actively pursues the SBIR/STTR Grant opportunities 
(http://www.sbir,gov/aboui/about-sttr) as well as cyber security related consulting. Since 
CRISP has various strategr partners, which provides various types of expertise, I would like to 
enter into the NSA's Technology Transfer Program. Thanks in advance for your time and I look 
forward to your reply. 

Respectfully, 



. , . • 

Foundei and CEO, Cyber Research apd kit^lligent Solutions Provider 


(CRISP) 




Doc ID: 6687078 


(b) (6) 


From: 

To: 

Subject: 

Date: 

Hi, 

1 recently attended the IAS ( onference and received material about USB and Data Port Protection 
products that you are deveh 'C ng. We have determined that the RJ45 (Ethernet) Port Protector 
would fit one of our current needs perfectly. On the brochure it states that samples are available, 
would we be able to get som, samples so that I could show this off as a potential solution? If we go 
ahead with this as the solution, how would we purchase them? Thanks in advance for your help. 



Interested in Data Port Protection Products 
Wednesday, AL:gust 19, 2015 11:47:22 AM 



Information Assurance Specialist 
Cyber Security Operations, Org 00097 
Sandia National Laboratqrie:^ tv15.1202‘ 
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From: 

1 r 

To: 

Tech Trance; . 

Cc: 

1 _ 1 

Subject: 

NC State Unive's ty IP 

Date: 

Tuesday, August 18 , 2015 12:21:23 PM 


To whom it may concern. 

I am from the Tech Transfer office at North Carolina State University. We have 
received an invention disclosure in our office that had NSA funding through our 
Laboratory of Analytic Sciences. 

Under the Bayh-Dole Act. we are required to notify the federal agency of any such 
subject invention. Typically I do this through iEdison, but NSA does not seem to be an 
agency that uses that interface. 

Would you please direct me to the person who I should notify? 


Thank you, 


I [ m LIS 

Assistant Director, Operations k Strategy 

Office of Technology Transfer 

North Carolina State Unit ersity 
1021 Main Campus Drive 
Campus Box 8210 ^ . • 

Raleigh, NC 27695__ . * 


No trees were killed in the sending of this message but a large number of electrons were terribly 
inconvenienced. 


(b) (6) 

P. 

I .. 


technology= 15263 








Please see attached letter w ivtngto Government all rights in invention 2013-058. 



Office of Innovation Advan( .'inent and Commercialization 

570 Devall Drive, Ste, 102 .. ■ 

Auburn, AL 36832 .." 
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AUBURN UNIVERSITY 

Ol'J'lCl' ( T R ’ Ai'ioN AdvancrmI':nt and Commerciai.i/.ation 


June 1, 2015 


National Security Agency 1 echnology Transfer Program 
Via £?/r;a//. tech_transfer(5.'i I^a.gov 
9800 Savage Road, Suite (>848 
Ft. Meade, MD 20755-6848 

RE: DOD/NSA Contract/Cirant No.: H98230-12-C;l_102-1 AF , _ , 

PI- I f . 


(b) (6) 


AU Invention No.: 201.4-058 “Micromachined Rare Earth Magnet DC Current Sensor’ 
Disclosure Date: 6/24 2013 (Previously reported via USPS) 


To Whom it May C oncern 

Pursuant to the abox'e-refci cneed contract/grant notification of the invention previously reported, 
please note that Auburn Tiii \ ersity waives to Government all rights in the referenced invention 
on this date and will take no further action in this matter. 

Please feel free to contact oui' office with any questions or concerns you may have. 


Best reuards. 


Technology Transfer Assistant 


C: 

AU Office of Sponsored Programs 


(b) (6) 


■\ Uivision oflhi ()I I K;K (. M' VICK PKKSini NT K(l!( RI^M,A1U;|I KCONOMK 1)1 V 1.1,0 P M I: N 1 

.S"U I' vail Dr :itc U)2, y\uburit, .\! 36832: T< iLphonc; 3.34-84-4-49^’^. l ax: 334 B44-.S962- 


. a 11 b u r n . c d 11 j w w \v . i a c . a u b urn. c d ii 






Subject: RENOIR 

Date: Monday, April 13 2015 9:11:56 AM 


Mv name is| fand I am a Research Associate at the Naval Postgraduate School (NPS) in 

Monterey, CA. I work at the Remote Sensing Center here at NPS, and we are interested in obtaining a 
version of and/or getting a license to use RENOIR. How would we go about doing that? 


Thank you for your time! 
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From: 

To; 

Cc; 

Subject; 

Date; 



Request for Blue Scope Tool for Navy Enterprise Network Us§ 
Thursday, Nocen’ber 19, 2015 5:34:49 PM , • * 


t 


Sirs, . • * 

I'm looking for tlic concct coiiCiu: :ii NSA to start eomniiinications on obtaining the Blue Scope Tool set for use on 
the NavT,' Continuous* ITa'ining 1 n\ ironnient (NCTE) network. I'm the Network Operations Director and our Flag, 
RADM| frequesied thai w c obtain the Blue Scope tool set to ensure that our network stays CCRl ready year 

round. iTiawTiualitied system administrators and lA specialist that can take any required training for the tool. 1 
would work the government traiislci agreement that may be required Please forward this email to the government 
representative that handles soft w aic use agreements for NSA's Blue Scope tool. 

Thanks. 




£ o r 
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From: 

To; 

Subject: 

Date: 



speaking at science fair 

Wednesday, February 11, 2015 7:03:28 PM 


(b) (6) 


Dear NSA, 

I'm writing w ith regards to the 1 ech I ransl'er program 1 heard about when 
1 visited your headquarters as pan irl'the Defense Science Study (rroup. 
of which I'm a member I’m a prolcssor at Stanford and my lab uses 
nanotechnological tools to invcciigatc the immune system. 

Wdten I w'as there. I asked about the possibility of speaking at my kids' 
elementary school science fair and \our folks mentioned that outreach ol 
this kind was definitely possible I m writing to see if you nnglit be 
able to speak on March 11 on the Mibject of cryptography. The target 
audience is K-5 grade (ages 5-1 1 1 ! he forum is our 3rd annual Science 
Night at Escondido Eleinentaiy scliool, which is a festival ol hands-on, 
inleraclii'c scientific exhibits A presentations. Last year we had a 
cardiologist dissecting a heart, geophysicists showing off earthquakes, 
astronomers showing off stars and the moon, a robotics team slunving oil 
their basketball-shooting robot etc It's a lot of inn lor the kids to 
be exposed to so much science and icchnology. Ihe elementary school 
services many of the children ol stanlord faculty (like me) and my 
access to Stanford makes it possible to get such aw'csome speakers & 
exhibits. Right now. however, maih is quite under-represented in our 
Science Night. We'd Kw e to haw a speaker talk about, say, simple 
substitution ciphers or other topics related to code making or ctide 
breaking that young kids would appreciate. 


Thanks for your consideration Please let me know it it can be done. 
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From: 

To: Tech Transfe : 

Subject: TTP & website? 

Date: Monday, Apri' 20. 2015 1:42:29 PM 


(b) (6) 


Hello, 


I recently attended a GovCon event at the Center Club and heard about your TTP, Given the goals of 
the TTP as stated on the wehnte; 

htl[;s:-'/vvwv.f.ii?,!.r . /rese ■ rh ti,i! V.ttM /ii.vine: he;iiiwindt-x.^^--ni I wanted to know what 

marketing support you provide for the program partners? As the saying goes, building a better 
mouse trap doesn't necess.a Iv lead to a successful business venture without effective sales and 
marketing. 


My primary interest is in the oesign/development of websites to support commercial products when 
they're ready to launch. How s this currently handled? 

Who would be the POC to ( ontact to discuss working with your partners? 


Regards, 



Graphic Beans 




(b) (6) 


wwv/ araphicbeans.coni 
Facebook 

MD Green Registry Mem ber 
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From: 

To; 

Subject: 

Date: 


(b) (6) 


Tech Transfe 

Detecting SIM Card Removal and Reinsertion 
Wednesday, Mav 18, 2016 3:24:37 PM 


Hello To all of NSA TEAM!! 

We are interested to get more information about Detecting SIM Card Removal technology. 


Best Regards 


(b) (6) 

|PhD 




President 

YashaSolar IncNew .. 

-r "' 
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From: 

To; 

Subject: 

Date: 

Hello, 

I'm an engineer and journalist at The Times interested in information regarding the NSA TPP 
program. Specifically, I'm interested in looking at existing patent license agreements for NSA 
technologies. Is there a piocess through which I can request license agreements as well as the 
corresponding letters of a|iplication and business plans? 




TTP information inquiry 

Thursday, December 17, 2015 1:07:39 PM 
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From: i I 

To; Tpch Transfe 

Subject; Dual Use Tedi Tiansfer 

Date: Friday, Novembe 18, 2016 11:07:Q8AM • * ’ 

^ • 

.^ * 

I ami f 1 work at BMPC. We are trying to develop a plan to secure our 

instrumentation and control equipment and am interested in seeing what technology is 
available and can be transferred to our application. 


My number is 
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From: 

To; 

Subject: 

Date: 

Hi. 

We are in the process of pufung together a symposium in partnership with NIST that highlights how 
companies can successfully work with federal labs through cooperative research. The theme of the 
event is to highlight the im[ ' stance of innovation to the economy and the role of federal labs as 
partners/innovators through funding and supporting basic research. 

The event will have panel di- ;: ussions featuring companies that have successfully developed 
technologies in partnershij ■ tederal labs through Cooperative Research and Development 
Agreements (CRADA), Tecfniology Investment Agreements (TIA), Grants, or other transactions. We 
are interested in areas of b e data/analytics, cybersecurity and energy. We are also interested in 
learning about innovative wu! k of companies in other technology areas as well. 

Has the National Security Aj.’ency worked with any Fairfax County companies to develop new 
technologies that might be is od panelists? If you have not worked with any Fairfax County 
companies, do you fiave am. horn northern Virginia area who might be good panelists/speakers for 
our event? 

Please feel free to call me i' . ou have any questions. 


Manager, Business Research 

Fairfax County Economic Dt. velopment Authority 
8300 Boone Boulevard, Siiib" 450 _ , . 

Tysons Corner, VA 2218^ 




Upcoming Symoosium on Federal Labs/Cooperative R&D - Panelists Needed 
Thursday, August 20, 2015 2A9A9 PM 
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From: 

1 - r 

To: 

Tech Transfei .’ 

Cc; 

1 1 

Subject: 

Your Tech Trat'sfer program 

Date: 

Sunday, November 22, 2015 11:50:53 AM 


Dear Sir/Madam, 


I'd be interested in ktiowinf; more about your Technology Transfer program, and how/if my group 
could participate. 


Below you find all my refet ern es and contacts. 


Best regards, 


%%% . • 

f ' 

r’tofp.ssor of Algol ms 
r)ef)artment of r.v-, outer 
University of l;. ly 
WWW , skvpe . hangout, link, 

' •’%%T' 




twitter 

' ' '-//o % % % 


(b) 


ed 1 
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From: 

To; 

Subject: 

Date: 


Hello, 


(b) (6) 



Tech Transfe 

Accelerated Batch Digital Signature Verification 
Monday, Noveinbe' 21, 2016 4:35:01 PM 


My name is_with Academic Tec hnology Ventures and/l am contacting 

you on behalf of one of our technology specialist ! |with Academic 

Technology Ventures Inc. f www.academictechventures.CQm ). ! f is interested in 
speaking to you about a technology you currently manage, specifically; Accelerated 
Batch Digital Signature I crification 


( 6 ) 


I [ is available most days 9 am-5pm EST. Please let me a know day and time that 
works well for you to discuss this further. 


I look forward to hearing from you. 


Thank vou. 



University Cooi dinatm' 

Academic Technologs \ enture-. Inc. 


(b) (6) 


y 


The Founders of Plasma Stream Technologies, Inc. - plasmastreamtech.com 
As Featured in Popular Mechanics Magazine and NewScientist Magazine 
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From: 

To; 

Subject; 

Date; 


Good morning, 

1 am a DoD coniraclor suiipoinng ihc Defense Conlrael Management 
Agency's (DCMA) Information Assurance Directorate Given that I have prior 
Blue Team experience w ithin the I )oD. I have been tasked to establisli a Blue 
1 cam program lor DCMA to coiuiuct tnternal assessments ot oiii netwoik. 


Tech Transfe : 

Acquiring Toolsets 

Tuesday, May I"?, 2016 10:15:12 AM 


1 would like to get some inlormation on the possibility and the 
process of our agency acquiring tools to support thts objective. Any 
tnformation or guidance on this maiter would be much appreciated. Thank you. 


(b) (6) 

Very respectfully. .' 


lA Program Support IC F Internal tonal 
Cyber Security Assessment Team 
On Site Supporttng: 

DCMA Fort I ee. VA_. . 






Doc ID: 6687093 


(b) (6) 


From: 

To; 

Subject; 

Date: 

Attachments: 

Dear NSA Tech Transfer ( olleagues. 

Our office at the Universii\ of Maryland will be working with the Association of University 
Technology Managers (Al IM) http //\\ ww.autm.net/ to organize Cybersecurity Industry 
Partnering Forum, similar to these partnering forums; httpb/www.ailim.net/events^ 
coiirses/aut in-partnering-iiMTims; 


Tech Transfe: 

AUTM Industry Partnering Forum 
Tuesday, July 19. 2016 3:05:57 PM 
AUTM Partnei• crum oroDOsal.docx 


At this event technology transfer professionals from different universities and research 
institutions will be able to network with representatives from companies, learn about their 
cybersecuritv needs and pt esent technologies available for licensing. 1 am attaching an internal 
proposal giving you more details about the event. 

Would you be interested to participate in the evenU Would you like to serve on the 
organizational committee ’ I he committee will be meeting about once a month. 

Please let me know if you ha\e any questions or concerns and if you'd like to have a phone 
call to discuss this further 


Thank you, 

□ . 

I [mBA'13 

I echnology Licensing Associate, Information Scienc? . • * ‘ 
Office of Technology Commercialization ^.. • * ‘ 
University of Maryland 
2130 Mitchell Building 
College Park. MD 20742 • * ' 


(b) (6) 


3 ft 
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Proposal: AUTM Partnering Forum: 

Cvbersecuritv . 
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1 

-^. 



AUTM Partnering Forum: Cybersecurity 



Proposed time: Early June 201 
Location: The Hotel 


Reasoning; The University of iv'.ai yland, College Park is located in one of the leading areas in the country 
for cybersecurity innovation U'd within driving distance of many companies big and small that deal with 
cybersecurity: Lockheed Martni. Northrop Grumman, Leidos, the federal government and many others. 
The University is home to the Maryland Cybersecurity Center (MC2) where faculty are performing 
extensive cybersecurity reseaic !i, including wireless and network security, cryptography, secure 
programming, mechanisms fc' ensuring citizens' privacy in social networks, cyber supply chain research, 
attacker behavioral analysis, < ybersecurity policy, multimedia forensics, and the economics of 
cybersecurity, among other ateas, UMD is uniquely positioned to bring universities and industry 
together to explore licensing 'ti:d research opportunities in the area of cybersecurity. 


Goals: 

7-10 companies 
10-12 universities 

Sponsorship goal is $4,500 (3 (S) $1,500 each). 

Registration Revenue is $14,750 (50 @ $295) 

AUTM will provide: AUTM will provide help with logistics. AUTM will secure the hotel contract and will 
plan the logistics of the event with caterers, AV, etc. Where AUTM cannot help is in securing the 
industry participation. AUTM will market the event to their large database, but UMD and our 
committee need to do the leg work of personally inviting universities that we know are interested in this 
sector and contacting industry partners in this space. 

UMD responsibilities: 

UMD is required to provide the following support and logistics: 

• Meeting space (AUTM will negotiate and execute contract) 

• Conference rooms for plenary discussions 

• Exhibit space - tables for each organization represented 

• Space for meals 

• Space for private partnering meetings 

• Audio Visual equipment (complimentary or low cost) 

• Recommendations for catering services for meals (AUTM will negotiate and execute contract) 


• Recommendations for hotel accommodations (AUTM will negotiate hotel reservation contract) 

• Ensure availability for the point of contact person responsible (and person implementing if 
delegated) to work with AUTM staff on coordination of: 

• Meeting 

• Reception 

• Registration 

• All other logistics 

• Convene a working committee of 3-8 members 

• Ideally, the committee members would be active in that technology sector and have 

• numerous contacts with companies and universities in that sector. 







• Ideally, committee members will be half from industry and half from academia 

• Attend regularly scheduled conference calls 

• Work with the AUTM staff to secure sponsorship for the meeting 

• Current goals are $1,500 in sponsorship per sponsor with a total of $4,500 per event. 
Sponsorship goal may need to be higher if the proposal includes extra expenses, such as 

paying for meeting space or a special event. 


OTC Resources required: 


• Staff time: approximately 30 hours a month for 10 months 

• Marketing budget; $2,500 
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From: 

To: 

Subject: 

Date: 

Hi | 


Tech Transit 

Contact lETTK NSA Technologies 

Tuesday, June lu, 2016 10:00:56 AM 

- . . ■ • 
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My name is j 
technology transfer in th 


Jeditor-in-chief of a brand new IEEE publication meant to promote 
e field on industrial electronics (lETTN): 


http://'iettn.ieee-ies.Qrg/ 

I recently saw this article 

hnp- /WWW hizmnnthlv t . h ii lechnology-transfer-at-nsa-i nnovat i Qn- frQm-lab-tQ-market/ 

Do you know if that would be possible to respin this article on lETTN so that we can share it 
to our audience (there arc 4t 0,000 IEEE members) ? This audience is composed on one side 
of technical people developping technologies and on the other side industrial people 
developping & financing pi oduct development. 

Also. I notice that NSA has a lot of industrial electronics technologies: 


Imps wwv\nsa.uov/whai Ae-do/re seaich/technolouv-transfer/ 


That would be great to ha\ e you as a listed TTO on lETTN: 


Imp- , iettn.ieee-ies o^g/sub^el-ibed-ttos/reLnstel^-VQlll^-tmi 


It's free ! 

Let me know of any intei esl. 
Best Regards,r ■ 


ing.. Ph.D 


lETTN Editor-in-Chief 
IEEE Industrial Electronics S pciety 


Signup here -> iettn.k,i\ci 


(b) (6) 










Doc ID: 6687095 


(b) (6) 


From: 

To; 

Subject; 

Date; 



Monday, Novembe' 28, 2016 7:37:51 AM 



We are looking for more information about joining with NSA for a CRADA on signal processing and 
analysis to perform a joint effort to further some of NSAs existing tools and apply them to a secondary 
use case with in commercial cyber security world. Who would be the POC for more information on 
process to move forward on an effort like this? 
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From: 


To; 

Tech Transfei 

Cc; 

1 1 

Subject; 

Data Transfei Agent Training 

Date; 

Thursday, December 08, 2016 8:05:48 AM 

Importance: 

High 


(iood morninii. 


(b) (6) 


Mv supervisor! [n'lieetor ol'DS Army Aberdeen lest Center's Cyber Security Directorate asked me 

li'I could find out if you offer Da ui Iransfer Agent training. If so. please asvise. 


fhank You. 


I —I .,... 

US Arniv Aberdeen lest Centei 
Test Technology Dir. C yberSeeiii nv Div, 
Bids 5014. Room C-4 


(b) (6) 
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From: 

lAD c:CC 

To; 


Cc; 

1 1 

Subject: 

FW: Vulnerabiiit/ Tool Suite (VTS) 

Date: 

Tuesday, May 1 ^ 2016 2:06:28 PM 


(iiecliims 1 ech rranslei team. 


I've got a request from the Intel n.iiional Broadcasting Bureau for a Tool Sharing Agreement ot the Vulnerability 


Tool Suite. I've been provided the following contacts for the agreement. 


(b) (6) 


i echnical POC; 

1 1 


'(UNCTASS) 

1 ' ~l 


Admin POC: p. 

C=1 Manager. Insider 1 h i eat Program Office); Phonc;|_ 


1 


ITSl? - lAD Client Contact Center 


[ 




-Original Message. 


F torn; 

Sent; Monday. May 09. 2016 ^ .'"V PM 


To: 1AD_CCC 


1 


Subject: Vulnerability fool Suite (V fS) 

Dear NSA Information Assurauee Directorate (lAD). 


j (Mobile): 

'(l-NCTASS^ p.I ... •. 

If you need anything tuither ple.i'-c (.lo'nbtlKJsflalctcrreatl^ortt.’.■ .■ .■ .■.>......I,;.-.,*.. 


J(Ofticc);[ 

" • ■ ■ 


(b) (6) 


(b)(3)-P.L. 86-36 


(b) (6) 


On April 1st. 2016. the NSA l.\l > Client Contact Center (CCC) met witlif 


Jaini^ 


J 


of the 


Broadcasting Board of Govei noi s (BBG) Infomiation Technology Directorate. 1 hey made a presentation about 
information assurance products aiul services that could be made available to civilian agencies. 


I believe BBG's mission to biumleast to areas of the world in turmoil or under repressive regimes makes BB(. a 
good candidate for some of thc^e iuoducts and services. BBt.fs mission places its infoimation technology and 
broadcasters in the crosshairs ot malicious nation-state sponsored cyber threats. Consequently we believe CCC s 
Vulnerability fool Suite (V'l S , product would be a good complement to our cuirent cybersecurity tools and 
defenses, piease advise how w e .an establish the necessary agreements between BBG and NSA to acquire and 
operate the VI S product. 


Sincerely. 



















Doc ID: 6687098 


From; 

To; 

Subject; 

Date; 


(b) ( = 




Tech Transfe i 
NSA's Detecting SIM Card Removal and Reinsertion 
Monday, Marcri 06 , 2017 11:48:59 AM 


Hello! 


Mv name is| l-vith Academic Technology Ve ntnms Iwww.academictechventures.c.Qm ) and I 

am contacting you on oenaiT or orte of.our technology specialistsHe is interested in speaking 
to you about a technology you may curr*er1tly pianage - NSA’s Detecting SIM Card Kemoval and Reinsertion 

thttps://www.federallabs.ora-iii:iex.Dhp?trav=ccintent&tid=1FLtop199$ccid =16gPWSg) 

* • . . 

* • . ♦ 

• * • 

Q s available most days 8 am 5pm CST. Please let me know day and tirfieth^t works well fof you to discuss 

.. * * • . 

. •. • 


look forward to hearing from you 


Thank vnu, . , 

I- - 1 " 


m ^ * K * 


(b) (6) 


r 


I nivcrsin Conrdinatnr 
Academic Tcchnohmv \ enturc". Iik. 



y 


The Founders of Plasma Stream Technologies, Inc. - plasinastreamtech.com 
As Featured in Popular Mechanics Magazine and NewScientist Magazine 
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From: 

To; 

Subject: 

Date: 

Good Morning, 

I am trying to identify a signci for a TTSA between NSA and the FBI, and am getting hung up on our 
side with concerns about find ng a signer on our side equivalent to the Director, Office of Research 
and Technology Applications. Can you tell me if that position is a GS level, or SES level position. 


Operational Technology Div ion 
Federal Bureau of Investigat on 




Tech Transfe 

IC Transfer Question 

Thursday, March 03, 2016 11:08:15 AM 
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From: •. 

To; .. 

Cc; I I 

Subject: Patent #7,607,358 

Date: Tuesday, April IE, 2017 3:08:53 PM 

We are interested to get nn 7 - information on this technology for us to develop/market for 
commercial use. Please serm os the details to start this process thanks. 


Vice President 
AiNET Corporation 
www.ai.net 


(b) (6) 









Sh/Madam, 

I attended the 2017 Baltimore 1 eonl'eienee, and at the tech transler booth 1 spoke with someone who was an 
NSA employee at the tceh transiei hook. Unfortunately, she did not have a business card and 1 lost hei contact 

information. 

If it is avatlable. 1 would like to obtain K)UO and higher tech transfer portfolios, 

I am the Cyberseciirily fechnica! .Advisor at the undersea resource sponsor (OPNAV N97), and would like to 
promulgate material to our scieiu e advisors, leadership, and other strategic organizations. 

The catalyst was a particular set oiilie public patents caught my attention 


V/r, 
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From: 

To; 

Subject: 

Date; 


Tech Transfe: 

Interest in NSA's Data Port Protection and Tamper Detection program 
Thursday, November 24, 2016 12;27;49 AM 


(b) (6) 


Hi, 

I'm working in the network vocunty field in San Francisco, and am writing to learn more about your 
Data Port Protection and Tamper Detection program. Can you please point me to some useful 
resources where I might leai n more? 


Thank you. 


(b) (6) 


Varpath 

One Market Street 
Spear Tower 36th floor 
San Francisco, CA 94105 
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From; 

1-r 

To; 

Tech Transfe 

Cc; 

lAD c:CC 

Subject; 

Tool Sharing Ag eement ICO EPA 

Date; 

Friday, May 06, ZQ16 lOiS'tiAO AM 

(Ticetings ’ 

fecli 1 iansfci team. 


Fve got a request from the EPA l»i a fool Sharing Agreemenl of the Vulnerability fool Suite. I've been provided 

the following contacts for the aeiecinent. _ _ 

. 

A dmin POC: . ....••■■ ■ f ' 

ijilinsntttkin Setifrify (.)tfieer (SAIS());Phone: 1 I (EI^EI,ASS) w 


(b) (6) 


J 


1 eehnical PQQ 


. 

. .. "* i' 

.'I .. L T-ik.\1:A /Plmup I - * iOlflCC)' 


(b) (6) 


f- Office of 1 uvironwif-mal Intbilm'iii'on (‘olil) Cyltt;r..S';eurKV ^aff (C s'S): Phone J *!(< 

J3Mc^(VNC.1 ASS) I .. | (JWIL'S) 


If you need anything lurlher plca'c do not hesitate to reach out. 


Cheers. 


C lient .Advocate 
Client C'ontaet C'entei 


Infomialion Assurance 

Jirocioiriic 

COMMiP 1 

NSTS 1 . ■ ’ i 




(b) (3)-P.L. 65-36 
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From: 

To; 

Subject: 

Date: 


Presentation Invitation -Block Chain and Distributed Ledgers - Ana Keener, US Army (UNCLASSIFIED) 
Friday, November 03, 2017 4:05:29 PM 


( b ) ( 6 ) 


CLASSinCATION; UNCLASSIi IDD 

To whom il may crmceni: . 

On behalt'of Major Geiiera j | U.S. Amiy. 1 would like to invite a 

representative IVom NS A's Office . il Research and Technology to deliver a 
presentation to our Command Siiaiegy Ciroup session. This group meets with 
our commanding general to tocim on current and future technology tiends. 

This fonim is currently schediileil lo meet on Wednesday. 24 January 2018, in 
Sierra Vista, Arizona. 

The topic for this full-day, straiegic-level seminar discussion is "Block 
chain and Distributed I edgers ' 1 he intent of the Command Strategy Oioup 

(CSC) would be to identily how Block chain and Distributed Ledgers could be 
leveraeed to further our Cybei capabilities in the delense ot our nation s 
future networks. . 

MG I f co'mmands the U.S \i my's Network enterprise I echnology Command, 

which is headquartered at Tort I luachuca, Arizona and controls all the Anny's 
networks globally. Our mission encompasses the design, engiiiceiing, 
implementation, operation anti maintenance required to defend the .Army 
portion of the Department of 1 )e Icnse Information Network (DODIN). 

We are seeking executive-level briefers who can engage in discussions on how 
this Army organi/ation can nio\ e lorward in the luture with technology, 
processes, procedures, manpow ei. education and training, along with 
cooperative engaaement with imliisiiy. academia and other military' serv ice 
and interagency partners. We can discuss specifics ol your piesentation at a 
later day. Preferably in early I Iccember. 

The CSG is a monthly forum that focuses academic discussion ol emerging 
trends in Infonnation fechnologv at an executable level. While we see 
engagements as a relationship-building opportunity with our partners in the 
science. IT industry and academia, this particular foirim is not for 
acquisition of specific goods oi ^el vices. On January' 24th, our schedule 
allow's 90 minutes (1 hour for pi cccntation. one half hour for 
questions/comments) for each of our three invited guests to present on the 
topic. W'e also invite \ ou to p.iiiicipate in the other two 

presentations/discussions diiniiL’. the day. We will start at ()8()() and conclude 
before 1530. We w ill provide means to project slides for discussion, and can 
bring other supplies uiion retiue'-!> 

I am the appointed "session le:id" for this occurrence and you will be able 
to coordinate directly with me Mv contact information is below. 

Thank you for vour consideraiion If your company is not able to 
participate, any recommendaimne for organizations that may be interested 
would be greatly appreciated 


(b) (6) 


(b) (6) 


Respectflilly, 










SMO Collateral: W4N11AA4 
SMO SCI: W4NHAA? 


CLASSll'lCATlOTS: liNCLASMl H D 
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From; 

To: 

Subject; 

Date; 


Tech Transit 
TPP 

Wednesday, June 15, 2016 1:24:09 PM 


{b)(3)-P.L. 86-36 


Is there a book version of the PI >1 ’ ^ ’ 

(lJ//FOUO) f~ T t99 _ . • * 

CICISO, C'EH, F.ICSA. Secunt\ . • * 

Infoniiation Security Hngineeriiin SeniorJ’rolessionak ISSG 
EISSC: Monitoring Desk _ . • ’ 

Contractor (Eagle Alliance )* ‘ 
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From: 

To; 

Subject; 

Date; 



Presentation on open-source tools to ISSA Chapter 
Thursday, dune 22 , 2017 1:33:17 PM 


Hello, 

I was excited to read that Nso has open sourced a number of projects on GitHub, Do you have 
someone that would come 1 DC and discuss this portfolio at one of our monthly ISSA Chapter 
meetings? I think it would bv very helpful to our members to find out about all the tools that are 

available from NSA. 

By way of introduction, I an, t he VP for Programs for the Washington DC Chapter of ISSA (www.issa- 
dc.org). The Information Systems Security Association is a non-profit association of IT Security 
practitioners. We invite SMI s to present on topics of interest at our monthly meetings. We meet 
the third Tuesday of each nmTh at the Center for American Progress (1333 H St. NW) in downtown 



Vice President, Programs 

National Capital Chapter ^ . . • ’ ’ 

Information Systems Secuijtv Assbciation (ISSA) 









Good morning, 

1 -nil nuiuirnig lor coniacL mfornuiuon in relation to Technology rransler Sharing Agreements (ITSA), Cooperat.ve 
Research and Development Agacmcnts (CRADA), or Open Source Software Releases (OSS) agteements that out 
orgamzations/tenants may have cs-ahlished nr the past and are valid, helore we pursue oui own clter . 


Could you please tell me it there aie e 
POCs'.’ 


xisting agreements s in 


place for the following organizations and provide 


24 Air Force 

688 low. Information Operation- W itig or 688 C'W, Cyber W ing 

F18 lOG Inftrrmation (Iperatioi^ » noup or 418 COti. C yber Operations Group 

90 lOS Information Operations s.|uadron or 90 C(9S, Cyber Operations Squadron 

92 lOs' Information Oiieratioiis s>|uadroii or 92 COS, Cyber (Iperations Squadron 

346 TS, Test Squadron 

23 lOS, Information Operations squadron 

318 OSS. Operations Support Squadron 


V/r, 


TV.l.'SAl . . . • 

, • • 

Weapdiis and faclics 
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From: 

To; 

Subject: 

Date: 



Question about uevv GitHub page 
Thursday, June 22 . 2017 10:06:41 AM 



Hi there, . . • ' 

My name is | f and I'm a reporter at FedScoop. 1 noticed that the NSA recently launched a 
GitHub page and w ould ln\ e to hear more about it — when did the agency launch the GitHub 
pace? And why did the HS A decide to join GitHub in an official capacity at this time? 



Scoop News Group 









NSA Team. 

I Strategic Systems Program (SStS - SP24 Navigation Rrancli request 
information regarding the use ol I Slf and Data Port Piotection teelinology for 
use on SP24 Navigation laptop^ 

2. Please advise as to a\ ailabilii\ cost and procurement process for port 
protection devices. Are samples av ailable for assessment prior to purchase. 
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From: 

To: 

Subject: 

Date: 


Sir/Madam, 

1 am pleased to bring to the notice of your company, an available tender for the supply of your 
products line to the government of Malaysia through a tender. 


1 would like to know if your company will be interested to submit offer for this supply. 

Please confirm your interest and I will give you more information about the tender as soon as 
I read positively from you 



N/B PLS KINDLY RESPOND ONLY ON THIS EMAIL ADDRESS BELOW: 



f f 
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From: 

To; 

Subject: 

Date: 


(b) (6) 


Tech Transfe 

MULTIMEDIA INSTRUCTIONAL DESIGN SYSTEM / DIGITAL TRANSCRIPTION SYSTEM (SCRIBEZONE™) 
Wednesday, Marcn 01, 2017 5:46:45 PM 


Hello! 




(b) 


My name 

our technology specialists^ 


Tvith Acadgrpic leehnolcJgy 'Ventures and I a m contacting yoti on behalf of one of 
f t www academictechventures.com l J lis ir^terestei^in^peaking 

sntly manage - MULTIMEDIA INSTRUCTIONAL f 


to you about a technology you may currently manage - MULTIMEDIA INSTRUCTIONAL DESIGN SYSTEM / 
DIGITAL TRANSCRIPTION SYSTEM (SCRIBEZONE™) fhttDs://www.nsa.aov/what-we- 
rin/research/technolonv-tranD^s.-assets/files/nsa-technoloav-tra nsfer-proQfam.pdf). Please locate PAGE 
30 in the catalog. 


Will is available most days 9 am-6 pm EST, Please let me know day and time that works well for you to discuss 
this further. 


I look forward to hearing from you 


Than k \<iu. 



Tniversitv Com dinator 



■■Lcadcniic Tcchncilour \ cnturt ^ Iik. 


(b) (6) 


kl 


The Founders of Plasma Stream Technologies, Inc. - plasmastreamtech.com 
As Featured in Popular Mechanics Magazine and NewScientist Magazine 


;d t 
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From: 

To: 

Subject 

Date: 


Classification; IfNCLASSIFILI) 


To Whom It May Concern: 


As Senior Data Scientist under contract to NCiA's Office of Science & Methodologies. I am requesting the latest 
version of the RENOIR softwaic tool along with a user manual, and a technical reterence description ot the tool's 
use and capabilities with examples for Network and Cluster Analysis. 



Classification: 1TSCI ASSIFIl I > 



RENOIR Info Reauest 

Thursday, Apnl 2:, 2017 10:41:54 AM 









Subject: NSA + Wellsprng - FLC 2017 

Date: Wednesday, Apn 19, 2017 3:16:24 PM 

Hello, 

Great to see that the NSA is attending the FLC Annual meeting this year! As an organization 
with a robust tech transfei office, I know how important things such as automation, visibility, 
and sophisticated reporting are to the agency. 

I'm not sure how familiar \ on may be with Wellspring, but we've successfully helped over 200 
universities and research institutions enhance their tech transfer activities. As a result, a recent 
Association of Uni\ ersit> l echnology Managers (AUTM) survey has shown that Wellspring 
Sophia clients report 46° .1 more licensing revenue and filed 34% more patents. 

I wanted to see if you would be available fora 15-minute meeting during FLC 2017. We'd 
love to learn more about >our Technology Transfer activities as well as to share some exciting 
new enhancements to Wcllspring's Sophia and our recent migration of Flintbox, a Wellspring 
solution, with the .AUTM (ilobal Technology Portal. 

Would you be interested in connecting for 15 minutes'!' 
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From: 

1-r 

To; 

Tech Transfe 

Subject: 

Seeking info 

Date: 

Wednesday, June 21, 2017 6:55:38 AM 

Sir, 



How could I work for some NSA project and contribute to some project launched by NSA , 


lor 
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From: 

To; Tech Transfe 

Subject; NSA Technology Transfer Program (TTP) 

Date: Tuesday, June 27, 2017 8:29:31 AM 

Good morning, 

I have \A/orked closely with I ■:!* Meade for the last 10 years. I would like to talk to someone about 
the TTP program and how I (an help you sell more of your patents 

Please let me know who I sli ^ ild talk to. 
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From: 

To; 

Subject: 

Date; 



small question on your git projects 
Wednesday, June 21, 2017 9:31:30 PM 


I c) Whom ll May Concern, 

1 noticed that of all the projects \iui folks placed on GitHub, nothing 
in the area of A.I 'i' Do y ou folk-- ha\ e any public domain stuff in the 
area of A.I. Question (icneratioii ' li would be cool to see something like 
that on your GitHub paue. 



for 




Subject; [EEMSG: Marketing][Non-DoD Source] 2017 Gartner Magic Quadrant for IT Vendor Risk Management 

Date: Thursday, July 13 2017 8:03:27 PM 



In recent times, unmanaged risks from IT vendors have exposed organizations to data breaches, 
operational failures, and business disruptions resulting in huge financial losses and reputational 
damages. Moreover, regulations like OCC, PCI-DSS, GLBA, HIPAA Rule, and HITECH Act are 
focusing on greater accountability and better oversight on the governance of vendor relationships. 
This has made it imperative for organizations to proactively consider IT VRM solutions that 
effectively help mitigate the risks caused by IT vendors. 

Here is a complimentary copy of the latest Gartner Magic Quadrant for IT Vendor Risk Management 
Report that will give you a comprehensive overview of the IT Vendor Risk Management (VRM) 
solution landscape. 



Marketing Team 

y 

Governance, Risk, Compliance and Quality Management Solutions 


MetricStream sends email to those ndividuals who have provided permission to send ongoing communication via email. 
If you do not wish to receive ongoing communication via email from MetricStream: Unsubscribe 
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From; 

To; 

Subject; 

Date; 


Tech Transfe ' 

[Non-DoD Source; Need Patent License Info about Elliptic Curve Cryptography 
Wednesday, JuU 12, 2017 Si'I'liSS PM 


(b) (6) 


Hi, 

I am learning about ECC and have come across many web links to an NSA page that is 
supposed to be about liceiuring the ECC patents license from Certicom (Blackberry). 

The page does not seem to exist and all 1 can find is the Transfer Technology PDF which only 
seems to cover NSA patents 


Can you point me to a list of the ECC patents that are licensed for use? 


1 found open source softw are I want to test but 1 want to make sure it doesn't seem to infringe 
on any of the patents. If sto I'll have to get our legal and purchasing people involved, but I 
only have authority to inquire about the types of patent licenses available. 


Thanks, 


. . • : f 


(b) (6) 


NNL 


1 _ 

_ 1 







Doc ID: 6687119 


(b) (6) 


From: 

To; 

Subject: 

Date: 



[Non-DoD Source: Data Port Protection and Tamper Detection’ 
Wednesday, September 20, 2017 5:41:30 PJ“1. • 



Hello, ,_ f • * 

My name if l 1 I work for Tru Simulation + Training as an Air Force Contractor. I was 

wondering if I could get a little more info regarding the Data Port Protection and Tamper Detection 
application, specifically how much it costs, how it's deployed, and if it would work on RJ45 ports. 
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From: 

To: Tech Transfei 

Subject: [Non-DoD Source ! Requesting access to Data Tool for.. 

Date: Friday, August IS, 2017 12:16:03 PM 


Dear Tech Transfer @ NS,\. 

https //www.nsa.eov/whai we-do/research/technolonv-transfer/a ssets/files/identifvipa- 
cnnnected-data.pdf 

Here are my questions; 

I really need tool that does w hat it states in that description. 

Is there a development version for demoing and testing? 

What's the licensing cost'.’ 

Training? 

Does it work with Oracle PL SQL, Microsoft SQL Server, MongoDB, or PostGreSQL? 


a 


Homeiand Secifty .' visior ^ . . • ■ ’ 

Natioi'idl & Hornela Secu ^ . . • * * 

. . • * 

. . • • 

Idalio National Lab ratqr. • • ’ 6 North Fieinont Ave. j Idaho Falls. ID 83415-3790 


(b) (6) 
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From: L^— 

To: Te.:> Transi t 

Subject: [Non-DoD Souk e; DHS Patent Pool Inquiry 

Date: Wednesday, luiv 19, 2017 11:16:34 AM 

Attachments: ins. aOOl.pi 


(b) (6) 


Good Afternoon, 


I am working in a supporting, role for DHS in their Office of University Programs, Much like The N5A, 
we partner with Universitic'- across the country to help expand knowledge and capabilities. We are 
interested in developing a patent pool (licensing program) to help commercialize our Universities 
efforts. Would it be possibk^ to speak with someone regarding The NSA's licensing program, and 
maybe more specifically, hoev The NSA's COEs are integrated into the program? Thank you in 
advance. 


Best Regards, 



Support Contractor 
Department of Homeland Si-., urity 
Science & Technology Direi toiate 
Office of University Programs 


(b) (6) 


Horn' land 
Sccuniy 


d fc 
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From: 

To: 

Cc; 

Subject 
Date: 

National Security Agenc\ 

ATTN: Technology Transfer Program 
9800 Savage Rd., Suite 6843 
Ft. George G. Meade, MD 20755-6843 
Telephone; (866) 680-4536 
techtransfe rgnsa.uov 

Hi. 

Request License for US Patent 09812836 
https:/Tvwvv.google.com i.KUe ius,/US9812836 



[Non-DoD Source i Request License US Patent 09812836 
Tuesday, December 19, 2017 1:12:55 PM 


Please inform procedure 

DS Patent 098128.t6 

Reversible computation with flux ^''liions 

Abstract; A reversible supercontluciinc circuit includes a plurality of .loscphson transmission lines, A first line is configured to 
transmit a control fluxon when a lii-'t input is active. A second line is conligured to transmit a target lliixon to one ol a third a 
fc'l [more] 

Inventors: Kevin D. Osborn 

Assignees: The Ihiited States of .\nici ica as represented by the Director, National Security .4gency 

Publication number: 098128.36 

Publication date: Nov 07. 2017 

Application number: 14121007 

Imps. Datenis.iusiia.coi ii patent,-')- 


.. 

[____|foiinder start-up EETAI I 
Menlo Park, California 
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From; 

To; 

Subject; [Non-DoD Solk re Getting started with the TTP 

Date; Friday, Novenbe 17,2017 1:00:11 AM 




To Whom It May Concern; 


I enjoyed pursuing througli your website. I am ready to speak with a representative 
regarding the proper steps to begin partnership with the CRADA (Cooperative Research and 
Development Agreement), Please correspond via email,_ 



International PROOF Systems. LLC 
PROOF Smart Tags . . . 



to 
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From: 

1 

zr 

To: 

Tech Transfe 


Subject: 

[Non-DoD Souice 

ScribeZone(R): A Multimedia Instmctional Design System 

Date: 

Wednesday, Jui.' 

19, 2017 1:17:52 PM 

Hello' 




(b) (6) 


1 sent an email quite awhile ago e:s|'leasing Academic l edmology Ventures' interest m a teclmology you ma> cunently 
manage - 


SeribeZoneR; A MultimediaInstiuenonal Design System 

ScribcZoneR: A Multimedia Instructional Design System Device for and Method of Language Processing US 
PATENT # 8.38(1,485 | EXPIRES AUGUST 11,2031 ScribeZone'»'is an educational technology that facilitates 
development and delivers of interactive multimedia courseware for the classroom. ScribcZone(R enables 
instructors to s\ iichroni/e multimedia files with their corresponding written texts and then diside the media 
into manageable learning blocks to appropriately focus and challenge their learners. Instructors can customize 
and frame courseware with hints, glossaries, and links to outside resources. ScribeZonetRi presents the 
multimedia coui sesvare ami its sophisticated media playback system in one svindosv, making course materials 
easy to develop, access, na\igate, and complete. POTENTIAL APPLICATIONS: • K-12 and higher education • 
Foreign language and English as a Second Language (ESL) courseware development • Government, militarx, 
and law enforcement applications • Medical and legal transcription and translation • Media and broadcasting 


Our I echnolugy Specialist, Mr. | |i s still interested m discussing this further and any licensing opportunities that 

may still be available. Please feel IreeToTena all NDA ij needed. He is open to take a call most any day Monday through 
Friday from 8-5 EDT. 


Please let me know a good day and nine that works well for you to have a call 


I look forw ard to hearing from you 


(b) (6) 




b 


The Founders of Plasma Stream Technologies, Inc. - pl^smasfreamtech.cgm 
As Featured in Popular Mechanics Magazine and NewScientist Magazine 


i 
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From: 

To; 

Subject; 

Date: 


Tech Transfe 
[Non-DoD Sojice] Innovation 
Monday, November 13, 2017 4:35:19 PM 



(b) (6) 

% 


Hello Tech Transfer, , . • * ’ 

. • • ■ ' 

i'm| [ form('' f AO/R&T analyst for over 10 years stationed at both Havi/aii and Texas 

sites. I am now the security nchitect for an electrical utility in San Antonio, Texas. I am reaching out 
to you to inquire how our im iovation's team who are already working with local colleges (UTSA) and 
other entities can collaborm.e new ideas, research, innovation with your team? If I could please be 
put in contact with someory to start that process and have those preliminary discussions that would 
be magnificent. 



1 .. 

(b) (6) 




Security Architi ;t | f 

CPS Energy j i- i) Na’ ^ San Antonio, Texas ' 


cpsenergy.com 
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From; 

To; Tech Transfe 

Subject; [Non-DoD Souice TTSA software 

Date; Friday, August 11 2017 4:12:47 PM 


(b) (6) 


Hello. 1 am trying to find a ;: rTact to learn how I get a copy of some NSA testing tools for use in an 
unclass environment, I am i t sure what the process is or how long it takes to get access. Any 
detail or POC would be greab . appreciated. 
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From; 

To; 

Subject; 

Date; 



[Non-DoD Source’ licensing position 
Friday, September 29, 2017 6:08:21 PM 



Hello, 

1 am looking for the correct place to inquire about employment opportunities with NSA 
technology transfer. 

Is there a place 1 can go to become aware of current and/or future opportunities? 
Thanks, 



i f c 
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From: 

To: 

Subject 
Date: 

Hello NSA, 

I am an inventor and small business entity. 1 would like to opportunity to speak with you in 
regards to a technology transfer of US PATENT # 8,177,089 Reusable Tamper-Indicating 
Tube. It's something I can believe in and a product that a small business can handle. Please 
contact me at your earliest 


PCT Application US 17/2 1 18.^ 



US Patent 9,609,973 



[Non-DoD Source: US PATENT # 8,177,089 Reusable Tamper-Indicating Tube 
Friday, Novembe- 10, 2017 10:11:31 PM 
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From: 

To; 

Subject: 

Date; 


[Non-DoD Souice Inquiring about the process regarding partnership with !he TTP 
Friday, Octobet 06 , 2017 3:04:50 PM . • ' 


To Whom It May Concern: _ . • ’ 

Mv name is| fand I would like to receive additional information regarding 

partne rship with the N^A Technology Transfer Program. Please feel free to corresp ond via 
email, | _ 


Regards, 


International PROOF 
PROOF Smart Tags 


w ww.Internati 

nnalERQGI-v- Steins.com 

1 _ 



[CEO 

Systc'ms. EEC 
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From: 

-f- 

(D) (3)-F.L. 86-36 

To: 


Cc: 

liech Iranster , • 


Subject: 

Date: 

Date Confirmatio-’: CSG Session - Block Chain and Distributed Ledgers ^UttGLASSIFIED) 
Thursday, Decen-’-ber 21, 2017 12:33:46 PM , • ‘ 



CI.ASSIFICATION: rNCI.ASSlI II B- 


(jood Momina 


IZl 


I assume you are alieach' out ami won’t receive this email until your reluni. 

1 have cc 'd the team members \ou lequested 1 include during your absence. 


(b) 


Ma|or Generali_jstat'f secK iai\ has conlirmed the .lanuary 24, 2018 

date for the CSG Session. The exact time will follow. 

Any question or concerns please lei me know. ^ • 

, . • * 

Have a wonderful holiday! . • • ‘ 

. • • 

. . • • 

Respectftilly. , , • ‘ ’ . • * 




d PC 


AColS, G2, NETCOM 


SMO Collateral: \V4N11AA4 
SMO SCI: W4NHAA.1 


Cl ASSincATlON: I N'CTAs'sll |i.D 









Date: Sunday, September IQ, 2017 8:50:16 PM 

Tech transl'ci team. 

I am a uradiiate student at NC Stale I :n\ersity in the lEC program on a team interested in commercialization of the flexible 
Circuit technoloey that is listed in ills NS.\ Patent Portfolio (Patents #7.452,746 & #6,017,822). \\ e are hoping to get in touch 
with the technologists inventors and get some more information on the progress and capabilities of the technology. 

I've also copied members of my team to see the conversation. Let us know what we can do to help lacilitate this 



Graduate Studetit 


O 
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From: 

To; 

Subject: 

Date: 

Good Morning, 

As an introduction, EmeSe: ' ■ a small cybersecurity company headquartered in Northern Virginia. 
We are working with government contractor companies to secure their systems in compliance with 
the new NIST 800-171 and osociated DFARs clauses We reviewed the technology transfer website 
and think there are several : et hnologies that we could use to assist them to further secure their 
systems with some additiot i.h K&D. How do we go about finding out what is required to license 
these technologies or create a CRADA to work with you to extend the capabilities of these 
technologies and commercei ze them? 


Thanks, 





[Non-DoD SoLiicej Meeting on technology transfer 
Tuesday, September 12, 2017 10:44:43 AM 








Hi, 

Is there is any update on uctting in touch with the technologists inventors for tlie "Flexible Circtut" 
tedmology listed in the NSA Patun 1‘orllolio'.’ We have a tew qiteslions about the technology we are wanting to gel answered 
as soon as possible 



1 ech transfer team. 


1 am a graduate student at NC smk 1 hiiversity in the TFC program on a team interested in commercialization ot the 
Flexibre Circuit technology' that n lifted m the NSA Patent Portt'olio (Patents #7,452.746 & #6.017.822). U'e are hoping to 
get m touch with the tcchnologi'- inventors and get some more infomiation on the progress and capabilities of the 
technology. 


I've also copied members of ni\ leant to see the conversation. Let us know what we can do to help facilitate this 
communication process. 
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From: 

To; 

Subject: 

Date: 

Attachments; 


Tech Transfe r 

Fw: CRADA Reneival Request 
Monday, June 12 , 2017 9:23:38 AM 
Fullv Execute ' 1' CRADA 04-28-12.pdf 


(b) (6) 


From: | j 

Sent: Tuesday, June 6, 201 i !9:47 
To: tech_transfer(S)nsa.gov 
Subject: CRADA Renewal R: - nest 


(b) (6) 


Good morning, 

We are requesting to renew a previously executed CRADA agreement (see 
attached). 

Request contact information for the appropriate administrative coordination POC. 


Very respectfully, 


(b) (6) 


DIRECTOR, C4ISR PROGRAMS & TECHNOLOGIES 
MODUS OPERAND!, INC, 


www.modusoperandi.coni 
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From: L^——J 

To: Tech Transfei 

Subject: Documentation , Pamphlets for Exhibitors 

Date: Thursday, March 02, 2017 3:13:12 PM 


(b) (6) 


lech Transfer, 

We will be hosting an booth at ihu Nattonal Cyber Sumniit in Huntsville, AL, 06-08 .lune 2017. In an eflort to 
present as much information aboui NSA as possible, we were wondering if you had any llyers/pamphlets/hand-outs 
we could put on the table? Or do \ ou have someone you normally send to events like this that wotildn t mind going 

and sharing our booth ' 

Any infonnation would be greaiK appreciated. 


□ 


(b) (6) 


National Infonnation Assurance 1 ducation and Training Program (NIF.TP) , . • * ’ 
Attn: E7?. 6704 ^ ^ . . • • ‘ ‘ 

9800 Savage Road ^ . . • ' * 

Tort Meade, MaiyTand 20755-f'd"'4 ^ _ . • • ' 


National Infonnation Assuratiee 1 dtication and rraining Program 
Imps: WWW i:id i'ov MTTP/ 


CAT Community Website 
Imps: 'WWW eaeconuiiiinitv.oi;. 
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From; 

To; 

Subject; 

Date; 



Github page 

Thursday, June 22, 2017 11:45:23 AM 


Hey friends, 

I'd like to draft a story for ou; website about your new Github page. 

Has the public affairs office r Spared any statements from the T2 office that we could use 


Thanks, 







Aloha, 

I recently took o\'ei SSC PAC's I 2 olfice. so still learning some of the ropes. This week 1 had an inquiry trom an 
emiiloyee that I could not answ ci turning to you all for help, 

Basic question is who can sign a. a leadership POC lor your I'TSAs'.' Ic what level are you looking for. first level, 
second level managenicnt/supci \ I'lon. SES. Commanding OtTicer.... 

Short background: Our researdu i l^ working with Sandia National Laboratory to create a suite of software tools that 
can be used to conduct cyber-tcsiing of IP-based systems. As part of this project they intend to use software that was 
originally developed be NSA and being made available to use through a Technology I'ranster Sharing Agreement 
( ITSA) So in order to get accc'.^ u> the software we need to fill out and submit the fTSA.... 


For additional learning and a chance to improve our office, can 1 leani more about your 1 echnology 1 lanstei 
Sharing Agreements ( ITSA)? li might not be an option in the DoD. but never hurts to leant more about what others 

are doing in the T2 arena. 




ad f 







Doc ID: 6687138 


From: 

To; 

Subject: 

Date: 



TWO TECHNOLOGIES TO DISCUSS 
Wednesday, Matcn 08, 2017 1:06:22 PM 


( 6 ) 


Hello! 


My name is l "f with Academic Technology VenturesJWAAA^^ 

am contacting you on behalf of one of our technology specialists, Mr I 
you about two technologies you may currently manage: 


■ itiictechventures.com ') and 1 
He is interested in speaking to 


1. CRYPTOGRAPHIC KEY EXCHANGE USING EFFICIENT ELLIPTIC CURVE Page 15 of 
catalog 

2. DATA RELATIONSHIP AND VISUALIZATION TOOL (RENOIR) Page 38 of catalog 


I t s available most days 8 am-Spm MST. Please let me know day and time that works well for you to discuss 
this further.. 


I look forward to hearing from you 


; I 


(b) (6) 


Thank v(iu, 

I-1 


I nivtrsit> Codi dinatni 
Academic Technohitn \ enturv^ liu.. 


ii 


The Founders of Plasma Stream Technologies, Inc. - pla?rn96treamtechiCOm . 
As Featured in Popular Mechanics Magazine and NewScientist Magazine 
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From: 

To: 

Subject: 

Date: 


Inquiry about rationalsecurityagency.github.io 
Monday, June 19, 2017 9:22:50 AM 


Hello, 

I’m writing this on behalf ol' Fossbytes, a growing technology media website that extensively 
covers the developments l i om open source and security world. A couple of hours ago I spotted 
this website I https: 'nation.i!se curitvagencv.githtlb.ioZ) on the Hacker News and I wondered it 
it was a new website from NS A. 1 also read a report from The Next Web that wrongly 
mentioned that “now" NS A has a GitHub account. I wished to inquire about the same. It 


would great if you could lell me more about the https i /Znat i onalsecurityagencY g 
website, its puipose, age. and NSA’s future plans to contribute to open source. 


(b) (6) 


Co-fo under & Editor-in-cliiei, 
Email:! 
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MATIS ?? 

Tech Transfei 
SPECK 

Tuesday, July 11, 2017 12:30:57 AM 


My name is I 

1 am engaged in MA I IS Inc. aiui >nii office is located in 1 okyo .lapan. 

We are developing loT based pnuluets such as power consumption 
measure and control system , Inn iisuni Detection system in the railway etc. 

We intend to implement authenikaiion and encryption timction into oiir 
product with lightweight encr\pU''n algorithm. 

We found the SPECK in the lightweight enci-yption evaluation report 
published by NICT .laptm. NIC 1 W eb site is as follows. 

http Clvpiiec.go.ip tonics.^crvr .:'. 20171)6?ll c16k'P0 1 1 .1 iU u1 

In the report various eneryjition :ilgonthnis was listed . we felt that 
SPECK is the most appiopriatc encryption algorithm for our products. 

We want to know about SPECK tmtl we hope a sample source code ot SPEC K. 
Please let me know if ii is accepiable or not. 

We are very sony but MATIS w ;T' instituted in December 2016 and does not 
have 

Web site until now. 

MATIS is the subsidiary companv of M fES and its Web site is as follows. 



From: 

To; 

Subject: 

Date: 


Hello 


(b) (6) 


Imp inte-s.co.inT, 

Best Regards. 


(b) (6) 



1 

. • • * • ■ ■ 

, . ... 


Chuo-ku. Tokyo. .Tapaii 
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From: 

To: 

Subject: 

Date: 



Tech Transfer Resources 


Monday, January 23, 2017 2:57:31 PM 


(loot! arternoon, 

I came across your icchnology li.mslcr program and would like lo mqunc 
about a couple of the agreemeni^ 

1 he 1 ISA to be more specific; aiul the CRADA. Any infonnation about the 
agreements and the process woiiki be greatly appreciated Thanks! 












